@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/licensing/candidates/apache-source-license-evidence.json

@@ -0,0 +1,478 @@
+{
+  "schemaVersion": 1,
+  "status": "source-license-declaration-evidence-not-rights-clearance",
+  "inventory": {
+    "path": "licensing/candidates/yara-forge-20260927.json",
+    "sha256": "4a1eb672e488b99d3381979a9eb1de4890edee79cfbcded9502683d48dbc7d54"
+  },
+  "originalEvidenceRecords": [
+    {
+      "path": "licensing/candidates/cado-source-declaration-evidence.json",
+      "sha256": "810cadb12983588a7001fee92a328fb6ac66e9e766eb90ed06d4f083ad341e36",
+      "bytes": 14070
+    },
+    {
+      "path": "licensing/candidates/blackberry-source-declaration-evidence.json",
+      "sha256": "662602c01d6cc755ace812570591d8257de3462562e0ca4b57fa33c3a1ff7e8e",
+      "bytes": 22826
+    },
+    {
+      "path": "licensing/candidates/blackberry-additional-source-declaration-evidence.json",
+      "sha256": "db922d1ab580eb09a01de5db83741f134a4446610a0762a4c91a0c298099de2f",
+      "bytes": 18753
+    }
+  ],
+  "legalcode": {
+    "sourceUrl": "https://raw.githubusercontent.com/cado-security/DFIR_Resources_Industroyer2/7133b61f23954990d22c6bd85de0e26871427425/LICENSE",
+    "path": "licensing/notices/candidate-sources/sha256/c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4.txt",
+    "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
+    "bytes": 11357
+  },
+  "declarations": [
+    {
+      "rule": "BLACKBERRY_Boratrat",
+      "blockSha256": "fd85a87f42417db24e6f196784d6311213bdf05d0a59e7c2f615eea0ab984ac2",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRAT.yar#L1-L41",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat",
+      "sourceUrl": "https://web.archive.org/web/20220429155135id_/https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat",
+      "sourceSha256": "ed1e622ecb9d22548629cd43d4c1f0c8443bfb66f9f5384908d5c34bc31c0a81",
+      "originalRuleName": "BoratRAT",
+      "captureTimestamp": "20220429155135",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Boratratinformation",
+      "blockSha256": "86045fff85de1a64665eb6f145ae543c275bf63bb91a2b67dd599f6ee9a98b04",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRATInformation.yar#L1-L45",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat",
+      "sourceUrl": "https://web.archive.org/web/20220429155135id_/https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat",
+      "sourceSha256": "ed1e622ecb9d22548629cd43d4c1f0c8443bfb66f9f5384908d5c34bc31c0a81",
+      "originalRuleName": "BoratRATInformation",
+      "captureTimestamp": "20220429155135",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Boratratkeylogger",
+      "blockSha256": "d7ce8042ea5f91d4376800f126ed2a6f9a049c71fe5c0bb9bd47c7504ca1f14a",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRATKeylogger.yar#L1-L39",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat",
+      "sourceUrl": "https://web.archive.org/web/20220429155135id_/https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat",
+      "sourceSha256": "ed1e622ecb9d22548629cd43d4c1f0c8443bfb66f9f5384908d5c34bc31c0a81",
+      "originalRuleName": "BoratRATKeylogger",
+      "captureTimestamp": "20220429155135",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Eternityclipper",
+      "blockSha256": "2726cef225aefb79e7cb4007f5641475668659d4b3bb97feb123eadc6cd6c773",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityClipper.yar#L4-L30",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceUrl": "https://web.archive.org/web/20220630210157id_/https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceSha256": "113311e588d228181f8ca2c75af5c32725c7ef14013368e779b72453e21db2e8",
+      "originalRuleName": "EternityClipper",
+      "captureTimestamp": "20220630210157",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Eternityransom",
+      "blockSha256": "1f2eb8993bb1e9fd431adcfdd783abf5a0d54a3b2b72c70b827e8874d51e67e6",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityRansom.yar#L4-L28",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceUrl": "https://web.archive.org/web/20220630210157id_/https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceSha256": "113311e588d228181f8ca2c75af5c32725c7ef14013368e779b72453e21db2e8",
+      "originalRuleName": "EternityRansom",
+      "captureTimestamp": "20220630210157",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Eternitystealer",
+      "blockSha256": "8ab404d8a2f1d46ed4e2be15a1e8d1256d48d41d7ffc1bd36e0908d3e64911fe",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityStealer.yar#L4-L32",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceUrl": "https://web.archive.org/web/20220630210157id_/https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceSha256": "113311e588d228181f8ca2c75af5c32725c7ef14013368e779b72453e21db2e8",
+      "originalRuleName": "EternityStealer",
+      "captureTimestamp": "20220630210157",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Eternityworm",
+      "blockSha256": "82e449fda7a8c46cfa591b61a4d8308ef162854d06a748568223e7249b9c904f",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityWorm.yar#L4-L31",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceUrl": "https://web.archive.org/web/20220630210157id_/https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on",
+      "sourceSha256": "113311e588d228181f8ca2c75af5c32725c7ef14013368e779b72453e21db2e8",
+      "originalRuleName": "EternityWorm",
+      "captureTimestamp": "20220630210157",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Headertip",
+      "blockSha256": "ef91bbe62b40b521c84973303b28be4f136856c9096d80f34d329cc7697ca556",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/HeaderTip.yar#L1-L18",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/04/threat-thursday-headertip-backdoor-shows-attackers-from-china-preying-on-ukraine",
+      "sourceUrl": "https://web.archive.org/web/20220414183041id_/https://blogs.blackberry.com/en/2022/04/threat-thursday-headertip-backdoor-shows-attackers-from-china-preying-on-ukraine",
+      "sourceSha256": "863b977ed07ee1f2ff7b0a8ac51b66ce247d9ec9b8b3ba90c684d4fe385da4a7",
+      "originalRuleName": "HeaderTip",
+      "captureTimestamp": "20220414183041",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_EXE_Jupyter_Cert_36Ff",
+      "blockSha256": "089bc0bdd7189e32bab80c5837f72358683180804c0a9b666db519e3019316b8",
+      "author": "BlackBerry Research & Intelligence Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_EXE_Jupyter_Cert_36ff.yar#L3-L18",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceUrl": "https://web.archive.org/web/20220113190614id_/https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceSha256": "4d107db87a11b8ad1aba14f2e58ea1f2154927c7a74d4fdf19648a4c3ef8b904",
+      "originalRuleName": "Mal_Infostealer_EXE_Jupyter_Cert_36ff",
+      "captureTimestamp": "20220113190614",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_MSI_EXE_Jupyter_Certificate",
+      "blockSha256": "ff8a2b33895337a27bd1581ed488d19790f904c66c9dc2d7bf78f644555e4dc2",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_MSI_EXE_Jupyter_Certificate.yar#L1-L43",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceUrl": "https://web.archive.org/web/20220113190614id_/https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceSha256": "4d107db87a11b8ad1aba14f2e58ea1f2154927c7a74d4fdf19648a4c3ef8b904",
+      "originalRuleName": "Mal_Infostealer_MSI_EXE_Jupyter_Certificate",
+      "captureTimestamp": "20220113190614",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_MSI_Jupyter_Embedded_Powershell",
+      "blockSha256": "8a94cbb1ee9381ea573e9ebb8be64a7b4eb2dd55d5119ad48cc2044c15a86250",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell.yar#L1-L20",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceUrl": "https://web.archive.org/web/20220113190614id_/https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceSha256": "4d107db87a11b8ad1aba14f2e58ea1f2154927c7a74d4fdf19648a4c3ef8b904",
+      "originalRuleName": "Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell",
+      "captureTimestamp": "20220113190614",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_Win32_Blackguard",
+      "blockSha256": "871272a43ebaaa3ccb7090c4f7c6589ef0cf9cf516fdb2f1a8ccf74231064d8d",
+      "author": "BlackBerry Threat Research team ",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_BlackGuard.yar#L3-L39",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/04/threat-thursday-blackguard-infostealer",
+      "sourceUrl": "https://web.archive.org/web/20220422040040id_/https://blogs.blackberry.com/en/2022/04/threat-thursday-blackguard-infostealer",
+      "sourceSha256": "060d2bde95c241cef82f95fcc9c726a0bf1b8e0fe7a753689100c4b8a9a74433",
+      "originalRuleName": "Mal_Infostealer_Win32_BlackGuard",
+      "captureTimestamp": "20220422040040",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Download_And_Execute_Module",
+      "blockSha256": "79ee456d5354a4c827efb67f94e0a05ebef94c87ff642dc220e8f8541b823f22",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module.yar#L4-L30",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceUrl": "https://web.archive.org/web/20220113190614id_/https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceSha256": "4d107db87a11b8ad1aba14f2e58ea1f2154927c7a74d4fdf19648a4c3ef8b904",
+      "originalRuleName": "Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module",
+      "captureTimestamp": "20220113190614",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Main_Module",
+      "blockSha256": "6b1274e7c8fc298cfaabdd672ca626b720dad790c53d93c57cde5ae35f6fa6e8",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_Jupyter_Main_Module.yar#L3-L42",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceUrl": "https://web.archive.org/web/20220113190614id_/https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise",
+      "sourceSha256": "4d107db87a11b8ad1aba14f2e58ea1f2154927c7a74d4fdf19648a4c3ef8b904",
+      "originalRuleName": "Mal_Infostealer_Win32_Jupyter_Main_Module",
+      "captureTimestamp": "20220113190614",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Win32_Chaos_Builder_Ransomware_2022",
+      "blockSha256": "ee16b70502aa218e0cb27a0321930d3d4a081ea2ad407b2c224c85b7e37b4a38",
+      "author": "BlackBerry Threat Research",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Win32_Chaos_Builder_Ransomware_2022.yar#L4-L44",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+      "sourceUrl": "https://web.archive.org/web/20220524122924id_/https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+      "sourceSha256": "0eecad03b5404f25ae29ae65e3f5c6aed52640162c7e890636b98f7511531c1b",
+      "captureTimestamp": "2022-05-24T12:29:24Z",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Win32_Chaosransomware_2022",
+      "blockSha256": "6abca8e28ae8fa4b6cdc368f7eefb24991f2d6ec3d8d0b973713fb0828fc8d0a",
+      "author": "BlackBerry Threat Research",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Win32_ChaosRansomware_2022.yar#L3-L45",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+      "sourceUrl": "https://web.archive.org/web/20220524122924id_/https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+      "sourceSha256": "0eecad03b5404f25ae29ae65e3f5c6aed52640162c7e890636b98f7511531c1b",
+      "captureTimestamp": "2022-05-24T12:29:24Z",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022",
+      "blockSha256": "08996bbbd5f4c33f9ee04a4a47142dd1b2fb5e7fdc328dede94a6e5f88eb14f7",
+      "author": "BlackBerry Threat Research",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022.yar#L3-L28",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+      "sourceUrl": "https://web.archive.org/web/20220524122924id_/https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+      "sourceSha256": "0eecad03b5404f25ae29ae65e3f5c6aed52640162c7e890636b98f7511531c1b",
+      "captureTimestamp": "2022-05-24T12:29:24Z",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Snake",
+      "blockSha256": "8a34db29325b1121bbb7ed6f82945a8186bad9a35aa95c40d02eb74e04797ad4",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Snake.yar#L1-L19",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/06/threat-thursday-unique-delivery-method-for-snake-keylogger",
+      "sourceUrl": "https://web.archive.org/web/20220616190946id_/https://blogs.blackberry.com/en/2022/06/threat-thursday-unique-delivery-method-for-snake-keylogger",
+      "sourceSha256": "25a25e717f9cee8ed943c890fca2228ff33b4eabfd8f455cf4f3c9dbc0ee6fed",
+      "originalRuleName": "Snake",
+      "captureTimestamp": "20220616190946",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Windealer_Executable",
+      "blockSha256": "96c90e1d7f24ce6ba5a092cb634686ac5eb46ec9c863e2bc22e732e1db81a0da",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_executable.yar#L1-L23",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware",
+      "sourceUrl": "https://web.archive.org/web/20220630222914id_/https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware",
+      "sourceSha256": "cd217fc2c9de02209e3cc19c0a59bd9826cd1042d76c3339ca91cf0ed7ed70e7",
+      "originalRuleName": "Windealer_executable",
+      "captureTimestamp": "20220630222914",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "BLACKBERRY_Windealer_Library",
+      "blockSha256": "cfa7fb90906a234a90fd8593f65b9aa92a77e808a8f54516f02c0b3dbfab3e52",
+      "author": "BlackBerry Threat Research Team",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_Library.yar#L1-L26",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware",
+      "sourceUrl": "https://web.archive.org/web/20220630222914id_/https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware",
+      "sourceSha256": "cd217fc2c9de02209e3cc19c0a59bd9826cd1042d76c3339ca91cf0ed7ed70e7",
+      "originalRuleName": "Windealer_Library",
+      "captureTimestamp": "20220630222914",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+      "declarationSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+      "evidenceRecord": "licensing/candidates/blackberry-additional-source-declaration-evidence.json"
+    },
+    {
+      "rule": "CADOSECURITY_Lambda_Malware",
+      "blockSha256": "7cf94ad72e026c794e3b2f690b2803bc7544651d74f35a3e4efc791a3e773715",
+      "author": "cdoman@cadosecurity.com",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Lambda_Malware.yar#L1-L17",
+      "sourceKind": "archived-original-author-page",
+      "originalSourceUrl": "https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/",
+      "sourceUrl": "https://web.archive.org/web/20220406131421id_/https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/",
+      "sourceSha256": "5bfd687b890d5b5f562d50eafd8eca6197881a7da53fb00eefff386c21139cfb",
+      "sourceHashKind": "archived-html-response",
+      "originalRuleName": "lambda_malware",
+      "captureTimestamp": "20220406131421",
+      "declaredLicense": "Apache-2.0",
+      "licenseBasis": "original-page-rule-metadata",
+      "licenseUrl": null,
+      "licenseTextAvailable": false,
+      "declarationText": "Apache License 2.0",
+      "declarationSha256": "e99dd4b311146507c3d0a887ca12e50387fe644c8aaa86cb500b50c068062543",
+      "evidenceRecord": "licensing/candidates/cado-source-declaration-evidence.json"
+    },
+    {
+      "rule": "CADOSECURITY_Linux_Wiper_AWFULSHRED",
+      "blockSha256": "d69b464c9826aae816d5e03a4efb9ad2b11e9eeb3423dab31577dfc09d08c532",
+      "author": "mmuir@cadosecurity.com",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Linux_Wiper_AWFULSHRED.yar#L1-L26",
+      "sourceKind": "original-author-git-file",
+      "originalSourceUrl": "https://raw.githubusercontent.com/cado-security/DFIR_Resources_Industroyer2/7133b61f23954990d22c6bd85de0e26871427425/YARA/AWFULSHRED.yara",
+      "sourceSha256": "fe9895685635da20cda7f9f1102226c847d3ae684eff0bab3a4e448ee0d6a225",
+      "sourceCommit": "7133b61f23954990d22c6bd85de0e26871427425",
+      "sourceGitBlobSha1": "763ff188b128aa59fae7be9c2a67a0eaa599374c",
+      "originalRuleName": "Linux_Wiper_AWFULSHRED",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "Apache License 2.0",
+      "declarationSha256": "e99dd4b311146507c3d0a887ca12e50387fe644c8aaa86cb500b50c068062543",
+      "evidenceRecord": "licensing/candidates/cado-source-declaration-evidence.json"
+    },
+    {
+      "rule": "CADOSECURITY_Linux_Wiper_SOLOSHRED",
+      "blockSha256": "b8b4c761e96a3eb8f9bf6f3b6408161d2d68bf1c59df08b382edffdde4541d5a",
+      "author": "mmuir@cadosecurity.com",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Linux_Wiper_SOLOSHRED.yar#L1-L17",
+      "sourceKind": "original-author-git-file",
+      "originalSourceUrl": "https://raw.githubusercontent.com/cado-security/DFIR_Resources_Industroyer2/7133b61f23954990d22c6bd85de0e26871427425/YARA/SOLOSHRED.yara",
+      "sourceSha256": "92490b31fb98b3178901b01820c022debd82347c720bf3b7b4a68b525bb315cf",
+      "sourceCommit": "7133b61f23954990d22c6bd85de0e26871427425",
+      "sourceGitBlobSha1": "52b94e4b05e56870328ea2b8c1e183fac16de3fb",
+      "originalRuleName": "Linux_Wiper_SOLOSHRED",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "Apache License 2.0",
+      "declarationSha256": "e99dd4b311146507c3d0a887ca12e50387fe644c8aaa86cb500b50c068062543",
+      "evidenceRecord": "licensing/candidates/cado-source-declaration-evidence.json"
+    },
+    {
+      "rule": "CADOSECURITY_Linux_Worm_ORCSHRED",
+      "blockSha256": "a59795afb657933804e19b65fa23e4f78ad7aa9c41f6f8325770495be1d818aa",
+      "author": "mmuir@cadosecurity.com",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Linux_Worm_ORCSHRED.yar#L1-L19",
+      "sourceKind": "original-author-git-file",
+      "originalSourceUrl": "https://raw.githubusercontent.com/cado-security/DFIR_Resources_Industroyer2/7133b61f23954990d22c6bd85de0e26871427425/YARA/ORCSHRED.yara",
+      "sourceSha256": "f16b9c8b99d0342f371a3c7e4456461d030c28bfa6659fb5d2848d7d3c29335e",
+      "sourceCommit": "7133b61f23954990d22c6bd85de0e26871427425",
+      "sourceGitBlobSha1": "01685b030da619b235553fc966ecc47e7c3ae06c",
+      "originalRuleName": "Linux_Worm_ORCSHRED",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "Apache License 2.0",
+      "declarationSha256": "e99dd4b311146507c3d0a887ca12e50387fe644c8aaa86cb500b50c068062543",
+      "evidenceRecord": "licensing/candidates/cado-source-declaration-evidence.json"
+    },
+    {
+      "rule": "CADOSECURITY_Powershell_Downloader_POWERGAP",
+      "blockSha256": "368687ef54b9f4d792afb0d05553f6d6be424462b4398ec3d74be29a5793ab35",
+      "author": "mmuir@cadosecurity.com",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Powershell_Downloader_POWERGAP.yar#L1-L19",
+      "sourceKind": "original-author-git-file",
+      "originalSourceUrl": "https://raw.githubusercontent.com/cado-security/DFIR_Resources_Industroyer2/7133b61f23954990d22c6bd85de0e26871427425/YARA/POWERGAP.yara",
+      "sourceSha256": "36f2c1352bcc092a0b3412dd3b453d76166c0a02a3872fd78433c9caafdd5e18",
+      "sourceCommit": "7133b61f23954990d22c6bd85de0e26871427425",
+      "sourceGitBlobSha1": "1861f55b4d6cc70ed681a35e5695b7465646f72c",
+      "originalRuleName": "Powershell_Downloader_POWERGAP",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "Apache License 2.0",
+      "declarationSha256": "e99dd4b311146507c3d0a887ca12e50387fe644c8aaa86cb500b50c068062543",
+      "evidenceRecord": "licensing/candidates/cado-source-declaration-evidence.json"
+    },
+    {
+      "rule": "CADOSECURITY_Whispergate_Stage_1",
+      "blockSha256": "8d11e440164cc70e4e1170c25839f72594739dbbe149e84973b97638cffb0436",
+      "author": "mmuir@cadosecurity.com",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Whispergate_Stage_1.yar#L1-L16",
+      "sourceKind": "original-author-git-file",
+      "originalSourceUrl": "https://raw.githubusercontent.com/cado-security/DFIR_Resources_Whispergate/58742dbebb54cf1d34a16d045515f1df6a7c405d/YARA/WhisperGate.yara",
+      "sourceSha256": "79d31438e075819e558b6d74abba4162937e1226d2389477803933c2c75eabc0",
+      "sourceCommit": "58742dbebb54cf1d34a16d045515f1df6a7c405d",
+      "sourceGitBlobSha1": "c1ef0b11a7f7ddb9a88650d32cbae7dc8d0afc36",
+      "originalRuleName": "Whispergate_Stage_1",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "Apache License 2.0",
+      "declarationSha256": "e99dd4b311146507c3d0a887ca12e50387fe644c8aaa86cb500b50c068062543",
+      "evidenceRecord": "licensing/candidates/cado-source-declaration-evidence.json"
+    },
+    {
+      "rule": "CADOSECURITY_Wiper_Ukr_Feb_2022",
+      "blockSha256": "40b05e0d4b3b822ba3db9cb3c77515e9d6d9590f41727c404404e143103ec548",
+      "author": "cadosecurity.com",
+      "aggregatorSourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Wiper_Ukr_Feb_2022.yar#L1-L18",
+      "sourceKind": "original-author-git-file",
+      "originalSourceUrl": "https://raw.githubusercontent.com/cado-security/wiper_feb_2022/ff5c61c740a7aadc96e348a82af492e11b08e52b/wiper.rule",
+      "sourceSha256": "5480d4c9e1cff79474dafa5a1b5834f2a2c58f31997ee85e91a283213ac64bdd",
+      "sourceCommit": "ff5c61c740a7aadc96e348a82af492e11b08e52b",
+      "sourceGitBlobSha1": "6dc7ae01e10863212033741c51c410ad35455a00",
+      "originalRuleName": "Wiper_Ukr_Feb_2022",
+      "declaredLicense": "Apache-2.0",
+      "declarationText": "Apache License 2.0",
+      "declarationSha256": "e99dd4b311146507c3d0a887ca12e50387fe644c8aaa86cb500b50c068062543",
+      "evidenceRecord": "licensing/candidates/cado-source-declaration-evidence.json"
+    }
+  ],
+  "selection": {
+    "rules": 27,
+    "sha256": "7049543e6494f9dc40b0591b975c53d03f8823522d3679f81e04a457c32d1108",
+    "digestAlgorithm": "SHA-256 of UTF-8 compact JSON declaration records with keys sorted, records sorted by rule code point, no trailing newline"
+  },
+  "unmappedRules": [],
+  "sourcePayloadEqualityEstablished": false,
+  "adaptationStatusEstablished": false,
+  "attributionAndDistributionObligationsComplete": false,
+  "rawRulePayloadIncluded": false,
+  "pinsChanged": false,
+  "commerciallyCleared": false
+}

package/dist/security-runtime/licensing/candidates/betterleaks-generic-api-key.json

@@ -0,0 +1,76 @@
+{
+  "schemaVersion": 1,
+  "status": "engineering-provenance-record-not-legal-clearance",
+  "component": {
+    "name": "betterleaks",
+    "version": "1.9.0",
+    "releaseCommit": "81aff7a638638aae3a659845d089043e1d8fe9ac",
+    "registryPath": "tools/registry/betterleaks.json",
+    "registrySha256": "502e6635125c26a2c895cbcf05b45f50424da771d559db01aa9125c9004a27eb"
+  },
+  "rule": {
+    "id": "generic-api-key",
+    "displayName": "Generic API Key",
+    "upstreamDescription": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
+    "source": {
+      "path": "cmd/generate/config/rules/generic.go",
+      "url": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.9.0/cmd/generate/config/rules/generic.go",
+      "sha256": "89afa6d460ea97d7ca2330433b839b7aedf6afad83251ec40cc35b813e42c57a"
+    },
+    "filterSource": {
+      "path": "cmd/generate/config/rules/generic_api_key_filter.go",
+      "url": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.9.0/cmd/generate/config/rules/generic_api_key_filter.go",
+      "sha256": "887ca1943fe2ef9fe4c7fe06fd1e471d7afa3f8b8007df84d6239cdfdd034a2a"
+    },
+    "generatedDefault": {
+      "path": "config/betterleaks.toml",
+      "url": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.9.0/config/betterleaks.toml",
+      "sha256": "a8f553eb634ac3c5c1ca3f0dc95e2b8abdea7d14b622604c5af07f30ce7926ef"
+    },
+    "defaultEmbedding": {
+      "path": "config/config.go",
+      "url": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.9.0/config/config.go",
+      "sha256": "9e0b14688a364aa12519f1e0caa1f66ce03d365f8484fc720b9cb63f4ab68bae"
+    }
+  },
+  "origin": {
+    "project": "gitleaks",
+    "commit": "782f3104786efdce0f809bce8a9ff31f2fa1c9ed",
+    "sourcePath": "cmd/generate/config/rules/generic.go",
+    "sourceUrl": "https://raw.githubusercontent.com/gitleaks/gitleaks/782f3104786efdce0f809bce8a9ff31f2fa1c9ed/cmd/generate/config/rules/generic.go",
+    "sourceSha256": "7ffad1b698b30865fabbe9c8d0b8ac9ebb9606a255bac591b81e63304c0264d4",
+    "initialBetterleaksImportCommit": "25a022692d1e2eef5b8b8c9b43d84321f9143d24",
+    "initialBetterleaksImportSha256": "47a3216fd96cb2b89e3405e3a12b2e8572b0a0b834b72e2399289b30f40ca9cd",
+    "comparison": "equal after replacing only the Betterleaks module path with the Gitleaks v8 module path"
+  },
+  "licenses": [
+    {
+      "attributionId": "betterleaks:generic-api-key",
+      "displayName": "Betterleaks generic-api-key rule, Zachary Rice (2026)",
+      "spdxExpression": "MIT",
+      "sourceUrl": "https://github.com/betterleaks/betterleaks/tree/81aff7a638638aae3a659845d089043e1d8fe9ac",
+      "licenseUrl": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.9.0/LICENSE",
+      "noticePath": "licensing/notices/betterleaks-1.9.0-MIT.txt",
+      "noticeBytes": 1069,
+      "noticeSha256": "caea114592a8f8e5e05a116d63a99e0ccd79a3ff74f4ddf270bcf4c929eb021e",
+      "modificationNotice": "The Betterleaks v1.9.0 rule is later work and is not claimed byte-identical to the cited Gitleaks origin."
+    },
+    {
+      "attributionId": "gitleaks:generic-api-key-origin",
+      "displayName": "Gitleaks generic API key rule origin, Zachary Rice (2019)",
+      "spdxExpression": "MIT",
+      "sourceUrl": "https://github.com/gitleaks/gitleaks/tree/782f3104786efdce0f809bce8a9ff31f2fa1c9ed",
+      "licenseUrl": "https://raw.githubusercontent.com/gitleaks/gitleaks/782f3104786efdce0f809bce8a9ff31f2fa1c9ed/LICENSE",
+      "noticePath": "licensing/notices/gitleaks-generic-origin-782f3104-MIT.txt",
+      "noticeBytes": 1069,
+      "noticeSha256": "e3884b252b3bfc045e55be43a34d1e80da070bc6f804ac95bf4660e97d62ebc6",
+      "modificationNotice": "Betterleaks' initial import matched this source after the documented module-path substitution."
+    }
+  ],
+  "limitations": [
+    "This record supports one pinned rule's engineering provenance and notice packaging, not formal legal clearance.",
+    "It does not establish the Betterleaks binary's complete transitive license or SBOM state.",
+    "It does not establish rule-pack coverage or detection equivalence.",
+    "Explicit, environment, or discovered Betterleaks configuration can replace the embedded default."
+  ]
+}