Register of exceptions: external software and services

Rule (owner, 22-10-2026): EUZOS uses no external software or services, unless this register holds an exception for that use that the owner has approved. Every exception is re-assessed every 6 months: can it by now be done with our own code or with a European alternative?

New external use (a crate, a plugin, a service, a program on a server) is only allowed after a completed checklist and approval.
An exception only applies to the described use ("for whom / for what"); other use is a new exception.
On rejection or when the re-assessment date passes, the use is phased out according to the plan in the entry.
See also APPS.md (the "own code" principle).
Research into alternatives for U-5, U-7 and U-8: research/2026-10-22-certificates-apps-roots.md.

The checklist (per exception)

Question	Explanation
What	name, supplier, version, licence
For whom / for what	which part of EUZOS, which users, which purpose; as narrow as possible
Where hosted / where does it run	country/region; does it run with us (code) or with the supplier (service)? In the EU?
Which data	which data of users or EUZOS passes through it or is stored
Dependency and risk	what happens if it disappears, changes or leaks; who is in control
Alternatives	own code, European alternative, what it would cost
Decision	approved / rejected / under review, with date
Re-assessment	at the latest 6 months after the decision
Phase-out plan	what is needed to replace it

Overview

ID	What	Decision	Re-assessment
U-1	Microsoft Graph / Microsoft 365 (sending mail)	approved (22-10-2026)	22-04-2027
U-2	Caddy (web server and certificates for the profile server)	under review	—
U-3	Ubuntu (operating system of the profile server VPS)	approved for now, until our own EUZOS server exists	22-04-2027
U-4	TransIP (VPS and DNS)	approved	22-04-2027
U-5	Let's Encrypt (certificates)	approved for now; investigate an EU alternative	22-04-2027
U-6	Rust crates of the profile server	approved	22-04-2027
U-7	Flutter and plugins (EUZOS app on the phone)	approved for now; investigate an alternative	22-04-2027
U-8	Mozilla root certificates (`ROOTS.PEM`)	approved; investigate an alternative	22-04-2027
U-9	Inter (typeface)	approved (free licence)	22-04-2027
U-10	Broadcom firmware for the wifi chip	approved (depends on the hardware)	22-04-2027
U-11	GitHub (storage of the source code)	approved (22-10-2026)	22-04-2027
U-12	Build tools: Rust compiler, Zig, Xcode, Android SDK, macOS	approved	22-04-2027
U-13	NTP pool (`pool.ntp.org`, time)	approved	22-04-2027
U-14	Servo (app engine), including SpiderMonkey and musl	approved for now; look at it again in 6 months	22-04-2027
U-15	Intel firmware for wifi chips (iwlwifi)	approved (23-10-2026)	23-04-2027
U-16	Chromium (full browser as an app, for Teams/Microsoft 365 and YouTube)	approved (23-10-2026)	23-04-2027
U-17	Ubuntu on the SSD of the FZ-G1, once, as a measuring instrument (iwlwifi tracepoints)	approved (23-10-2026), once	lapses after the measurement
U-18	Realtek firmware `rtl8712u.bin` for USB wifi sticks RTL8188SU/RTL8191SU (e.g. TP-Link TL-WN723N v1)	approved (23-10-2026)	23-04-2027
U-20	Microsoft 365 / Microsoft Graph and Entra ID for the user's mail and files (mail app, explorer); extension: signing in to the PC with the work account (26-10-2026)	approved (owner, 24-10-2026); extension under review	24-04-2027
U-19	Test tools on the Mac (ACPICA, Python with python-qrcode, headless Chrome): only as a yardstick when testing, never in EUZOS	approved (23-10-2026)	23-04-2027
U-21	Let's Encrypt ACME service for the Web server package of EUZOS Server (only the service; our own ACME client, no external code)	approved by owner 27-10-2026	27-04-2027
U-22	Raspberry Pi GPU boot firmware (`start4.elf`, `fixup4.dat`, Pi 4/5 EEPROM incl. TF-A on Pi 5) and board DTBs, only for `eos-rpi.img`	approved by the owner 29-10-2026; stored in `firmware/rpi/` (owner 29-10-2026: only `start4.elf`, `fixup4.dat`, `bcm2711-`/`bcm2712` DTBs and the licences; no Linux kernel images); `make image-rpi` uses it by default	—
U-23	Live Linux from a USB stick on <internal-name>, as a measuring instrument for GPU work (RAPL/RC6 numbers, `strace` of Chromium): never in EUZOS, nothing written to internal disks	approved by the owner 30-10-2026	lapses after the measurement
U-24	Intel GuC firmware `i915/adlp_guc_70.bin` 70.49.4 for the GPU on Alder Lake-P (`docs/drivers/specs/intel-xe-gen12.md`, phases X1-X3); HuC is not included	approved by the owner 31-10-2026; licence question for later (`docs/LEGAL-CHECK.md`, LC-2)	30-04-2027
U-25	Mesa `iris`, EGL, GBM and GLES without LLVM at runtime, libdrm, for Chromium with the GPU (`docs/drivers/specs/intel-xe-gen12.md` §17, phase X5); LLVM, clang, libclc, SPIR-V tools, gcc, meson, ninja, Python with mako, flex, bison and the Debian image as build-only tools on the Linux build machine only, none of them shipped; `anv` is not included	approved by the owner 31-10-2026	30-04-2027
U-26	intel-media-driver iHD (Free Kernel build), GMMLib, libva and libva-drm, for hardware video in Chromium (same spec §17, phase X8; build and pins: `docs/MEDIA-PACKAGE.md`; build-only tool on the build machine, not shipped: CMake)	approved by the owner 31-10-2026	30-04-2027
U-27	Test counterparts for the SMB client: Windows 11, Synology/QNAP NAS, macOS file sharing and the macOS SMB client as yardstick, `tcpdump` on the Mac for captures; outside EUZOS, testing only	approved by the owner 31-10-2026 (S-9)	30-04-2027
U-29	`vpx-tools` and `aom-tools` (libvpx, libaom; BSD) on the Linux build machine, to make test clips and their MD5 sums; outside EUZOS, testing only. The clips travel in `MEDIATEST.PAK`, the tools in no package. CMake is a build tool of U-26	approved by the owner 01-11-2026	30-04-2027
U-32	Ubuntu live USB on the HP Pavilion, once, as a measuring instrument for the Gen11 GT (`docs/GPU-GEN11.md`, I0; spec I915-2): nothing on the NVMe, nothing in the product	approved by the owner (01-11-2026, I915-2), once	lapses after the measurement
U-31	PostgreSQL as the database of the internal developer portal; on the Debian dev server, not in any EUZOS product	approved (owner, 01-11-2026)	01-05-2027
U-30	Noto fonts (Noto Sans CJK, Noto Sans Symbols and Symbols 2, Noto Emoji; SIL OFL 1.1) as fallback fonts in the Chromium package	proposed, not approved (01-11-2026)	—
U-33	Pwned Passwords range API (leaked-password check of the password vault, `docs/PASSWORDS.md`)	approved (owner, 03-11-2026); default off, the user turns it on	01-05-2027
U-34	Time zone data for the Agenda: the IANA time zone database's current rules (public domain) as the data package `TZRULES.TXT` and the built-in table, and the Windows zone names of Unicode CLDR `windowsZones.xml` (Unicode licence) in `libs/calendar` (`docs/AGENDA.md`, AG-1)	approved (owner, 03-11-2026)	—
U-35	Google Calendar (CalDAV endpoint or Calendar API) and Google OAuth 2.0 for the user's own calendars in the Agenda (`docs/AGENDA.md`, AG-2)	approved in part (owner, 03-11-2026): read-only through the user's secret iCal address now; a Google Cloud project with verification of the `calendar` scope later	—
U-20 ext.	Extension of U-20 to the user's calendars (Graph scopes `Calendars.ReadWrite`, `MailboxSettings.Read`, later `Calendars.ReadWrite.Shared`; `docs/AGENDA.md`, AG-4)	approved (owner, 03-11-2026)	with U-20
U-36	Google Identity (OpenID Connect, device-code login with only `openid email profile`) for logging in on the PC with a Google Workspace account; same Google Cloud project as AG-2 (T-1305)	proposed, not approved (03-11-2026)	—
U-37	PostgreSQL (PostgreSQL licence) with the Debian glibc runtime it needs, as an EUZOS Server package that runs in the Linux layer (T-1314); extends U-31 beyond the dev server. Source (owner, 03-11-2026: the newest stable release, never a beta or release candidate): the project's own repository apt.postgresql.org, suite `trixie-pgdg`, PostgreSQL 18.6 (`18.6-1.pgdg13+2`), signature of the repository checked against key `B97B 0AFC AA1A 47F0 44F2 44A0 7FCC 7D46 ACCC 4CF8`; the runtime libraries from Debian 13.7; versions and SHA-256 in `apps/postgres/MANIFEST.txt` and `SOURCES.md` (docs/PACKAGE-POSTGRES.md)	approved for a trial on the Gen10 (owner, 03-11-2026); inclusion in the product decided after the trial	—
U-38	PHP 8.x with PHP-FPM (PHP licence) as an EUZOS Server language package in the Linux layer, also for EUZOS Code (T-1316, T-1302). In the package (05-11-2026, `docs/PACKAGE-PHP.md`, pins in `apps/php/MANIFEST.txt`): PHP 8.4.24 (`8.4.24-1~deb13u1`: php-fpm, php CLI, the core shared extensions and opcache, pgsql/pdo_pgsql, mbstring, intl, curl, xml/dom/xsl, sqlite3, bcmath) with glibc 2.41 and the libraries they load (OpenSSL 3.5.7, ICU 76, libcurl 8.14.1, libpq5 17.11, ...), all from Debian 13.7, SHA-256 per .deb from `Packages.xz`; signed `linux` package `php`	approved (owner, 03-11-2026)	—
U-39	Node.js LTS (MIT) with npm as an EUZOS Server language package in the Linux layer, also for EUZOS Code (T-1317, T-1302). In the package (04-11-2026, `docs/PACKAGE-NODEJS.md`, pins in `apps/nodejs/MANIFEST.txt`): Node.js v26.13.0 LTS (`node-v26.13.0-linux-x64.tar.xz`, SHA-256 `d28a96af…d959e997`, in `SHASUMS256.txt` signed by release key `C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C`) with npm 11.20.0; TypeScript 7.0.2 with its native compiler and TypeScript 6.0.3 (Apache-2.0; "TypeScript first", owner in T-1317); glibc 2.41, libstdc++6/libgcc-s1/libatomic1 14.2.0-19 and dash 0.5.12 from Debian 13.7	approved (owner, 03-11-2026); JIT for `node` (as for Chromium) to be confirmed by the owner	—
U-40	Python 3.x (PSF licence) as an EUZOS Server language package in the Linux layer, also for EUZOS Code (T-1318, T-1302). In the package (05-11-2026, `docs/PACKAGE-PYTHON.md`, pins in `apps/python/MANIFEST.txt`): Python 3.13.5 (`3.13.5-2+deb13u5`) with its standard library and glibc 2.41 and the libraries it loads from Debian 13.7; pure-Python wheels from pypi.org (SHA-256 from its JSON API): pip 26.3 (MIT), gunicorn 26.2.0 (MIT), packaging 26.3, uvicorn 0.54.0, h11 0.16.0, click 8.5.0 (BSD), pg8000 1.31.6 with scramp 1.5.0, asn1crypto 1.5.1, python-dateutil 4.0.0, six 1.17.0; signed `linux` package `python`. On the server pip installs a site's `requirements.txt`: pure-Python wheels from pypi.org only, nothing built	approved (owner, 03-11-2026)	—

U-34: Time zone data for the Agenda

Status: proposed (03-11-2026), not approved. External data, no software: libs/calendar/src/tz.rs holds about 95 current zone rules (written from the IANA database's published rules) and 53 Windows names (from CLDR); the data package is designed, not built.

Question	Answer
What	(1) the IANA time zone database (tzdata, https://www.iana.org/time-zones), its current rule per zone as a POSIX TZ string; public domain. (2) Unicode CLDR `common/supplemental/windowsZones.xml`, the mapping of Windows zone names (Microsoft Graph, Outlook) to IANA names, territory "001"; Unicode License v3
For whom / for what	the Agenda on EUZOS Desktop: showing events of other zones and invitations at the right time; later the kernel clock (today fixed to Central European Time)
Where hosted / where does it run	data inside EUZOS (code table and a layer-1 data package); no service, no network at run time. The release is downloaded at build time
Which data	none of the user's
Dependency and risk	low: if the sources disappear, the last package keeps working; a wrong rule shows events an hour off in that zone until the next package. The licence of CLDR asks for its notice to travel with the data
Alternatives	our own collection of rules from governments' announcements: possible but slow, and exactly what the IANA volunteers already do; without data, events from other zones would be wrong
Decision	open: to the owner (AG-1)
Re-assessment	6 months after a decision
Phase-out plan	not applicable for public-domain data; the package can be made from any other source in the same format

U-35: Google Calendar and Google OAuth for the user's calendars

Status: proposed (03-11-2026), not approved. Nothing calls Google. The CalDAV client (libs/calendar/src/caldav.rs) is the same one iCloud and Fastmail use. Read-only Google calendars through the user's own "secret address in iCal format" are a plain subscription of a URL the user pastes, like any .ics link.

Question	Answer
What	Google's CalDAV endpoint (`apidata.googleusercontent.com/caldav/v2/`) or the Google Calendar API v3, with Google OAuth 2.0 (loopback redirect, RFC 8252 + PKCE) and a Google Cloud project "EUZOS" with a verified OAuth consent screen for the sensitive scope `https://www.googleapis.com/auth/calendar`
For whom / for what	users with a Google account who want their Google calendars in the Agenda, read and write
Where hosted / where does it run	Google's cloud (worldwide); not EU-only
Which data	the user's calendars, which are already at Google; Google sees that the user signs in to the EUZOS app. Tokens on the PC in RAM and in the encrypted profile directory, like the Microsoft tokens
Dependency and risk	Google can change or revoke the verification; the project's settings and the verification are an annual chore for the publisher; the Google API Services User Data Policy ("Limited Use") binds EUZOS (LC-6)
Alternatives	read-only subscription of the secret iCal address (no Google approval); the older CalDAV address with an app password (undocumented, may stop); users moving to a CalDAV provider in the EU
Decision	open: to the owner (AG-2)
Re-assessment	6 months after a decision
Phase-out plan	switch off by the feature-off list (`agenda-google`); calendars stay readable through the secret address

U-30: Noto fonts in the Chromium package

Status: proposed (01-11-2026), not approved. Until the owner approves, CHROMIUM.PAK stays with Inter only and subtitles such as [音乐] show tofu. The agreements of 23-10-2026 in CHROMIUM.md say "fonts: shipped in the package", but the U-16 addendum names only libraries and decision 9 there ("extend U-16 with ... free fonts") is still open, so this is put to the owner instead of assumed. Approving this row, or closing decision 9, is enough; the build then uses tools/chromium/fetch.sh --with-fonts.

Question	Answer
What	Noto Sans CJK Regular (collection, commit `f8d15753` of `notofonts/noto-cjk`), Noto Sans Symbols and Symbols 2 Regular (commit `e2ec4a11` of the Noto Project's fonts repository), Noto Emoji (commit `8b0a1d0f` of `google/fonts`). Licence SIL OFL 1.1 for all. Pinned with SHA-256 in `apps/chromium/fonts/MANIFEST.txt`, 22,365,928 bytes
For whom / for what	only `/app/fonts` of the Chromium package, as fallback for characters Inter lacks: Chinese, Japanese, Korean, symbols, emoji. Not the desktop's own text
Where hosted / where does it run	data read by FreeType inside the Chromium container; local, no service, no network. Downloaded at build time from GitHub
Which data	none
Dependency and risk	outlines read by Chromium's FreeType, as any web font is. Publisher in the US (Google, Adobe for the CJK design); if it disappears the pinned files keep working. Licence text goes along in `/app/licenses/fonts`
Alternatives	own font: not feasible for tens of thousands of glyphs. Inter (U-9) has none of these scripts: measured, `tools/chromium/fonts/check.py assets/fonts`. A European CJK font is not known
Decision	proposed, not approved (01-11-2026)
Re-assessment	6 months after a decision
Phase-out plan	leave out `--with-fonts`; tofu comes back, nothing else breaks

U-33: Pwned Passwords range API for the leaked-password check

Status: proposed (03-11-2026), not approved. The client is built and tested with a fake transport (libs/passwords/src/leak.rs); it is off by default and nothing calls the service until the owner approves this row and the user turns the check on.

Question	Answer
What	Pwned Passwords range API (`https://api.pwnedpasswords.com/range/<5 hex>`), a free service of Have I Been Pwned (Troy Hunt), served through Cloudflare; no key, no account
For whom / for what	the password vault on EUZOS Desktop: "is this password in a known breach?" when saving a password or on the user's "check all" in Settings › Passwords. Only for users who turn it on
Where hosted / where does it run	with the supplier, worldwide through Cloudflare's network; not EU-only
Which data	the first 5 hex characters of the password's SHA-1 (20 bits, shared by ~1 million hashes), the request time and the PC's IP address. Never the password, the full hash, a user name or a site. Requests use `Add-Padding: true` so the reply size does not reveal the hit
Dependency and risk	low: if the service disappears or changes, the check reports an error and nothing else breaks. A hostile reply can at most give a wrong "leaked" or an error (a malformed reply is never "safe")
Alternatives	an own range service on the profile server from the downloadable hash list (the list's licence is to be checked; ~40 GB, updated by the supplier): no third party sees the address; to consider after approval
Decision	open: to the owner. Legal side: `LEGAL-CHECK.md` LC-5
Re-assessment	6 months after a decision
Phase-out plan	switch off by the signed feature-off list (`passwords-leak-check`) or by an update; or move to the own range service above (same client, other host)

U-31: PostgreSQL for the internal developer portal (approved 01-11-2026)

Question	Answer
What	PostgreSQL, open source, PostgreSQL License (permissive; the licence text is to be recorded in `SOURCES.md` at install)
For whom / for what	internal only: the database of the IDP when it becomes a web app (`portal/README.md`). Not part of EUZOS Desktop, Server or Profile, and no release contains it
Where hosted / where does it run	the Debian dev server on our own LAN; the web app on EUZOS Server talks to it over the network. No cloud service
Which data	portal data: hardware, drivers, work, releases, tests, decisions, agreements and documentation. No customer data, keys or secrets
Dependency and risk	low: internal tool. The JSON in `docs/portal` stays in git, so the database can be rebuilt from it until the database becomes the source; then it needs a backup
Alternatives	an own small store in the Web server package: more building now, no exception
Decision	approved by the owner on 01-11-2026. Running PostgreSQL on EUZOS itself is a separate later test, not covered here
Re-assessment	01-05-2027, and every 6 months after that
Phase-out plan	move to a database on EUZOS itself when one runs there; the data is plain tables and can be exported

U-27: Test counterparts for the SMB client

What: a Windows 11 PC, a Synology/QNAP NAS, macOS file sharing and the macOS SMB client as yardstick, and tcpdump on the Mac to record captures. Limits: nothing of it runs on or ships with EUZOS. No source code of these products or of other SMB implementations is read (docs/SMB.md). Wireshark is not included. Captures contain no real passwords and stay out of git unless they are made for testing. Re-assessment: 30-04-2027.

U-24: Intel GuC firmware for the GPU on Alder Lake-P

Question	Answer
What	Intel GuC firmware `i915/adlp_guc_70.bin`, version 70.49.4, `linux-firmware` tag `20260916`, 347,904 bytes, SHA-256 `b7a800cbdcdf687e7b1c81f3316d040ab75fa3e5c698ebc356f077af17462ef8`. EUZOS accepts exactly this hash
For whom / for what	GPU driver on Alder Lake-P: submitting GPU work, power control, reset. Without it the driver runs only the execlist bring-up variant
Where hosted / where does it run	on the GT microcontroller of the machine itself; local, no service, no network
Which data	none leaves the device; the firmware has DMA access through the GGTT, see the spec's security section
Dependency and risk	closed code signed by Intel; only Intel can change it. Licence `LICENSE.i915`: its patent licence does not cover a closed-source OS, see LC-2
Alternatives	own firmware is impossible (the GPU checks Intel's signature); execlists without firmware, not investigated for production (LC-2)
Decision	Approved by owner 31-10-2026 ("gewoon bouwen. Niet beperken op juridische zaken"). HuC, DMC, Mesa and the media driver are separate decisions
Re-assessment	30-04-2027, and every 6 months after that; on any new firmware version
Phase-out plan	none while the GPU route uses GuC; execlists are the fallback if LC-2 requires it
Delivery (31-10-2026, owner requirement)	only as the signed layer-1 data package `fwxe` (`tools/pkg/data/fwxe`, blob and licence pinned in `firmware/xe/`), never loose in `\EOS\FW\`: an update can revoke it. No valid package means no GuC load and the machine stays on the CPU path (`libs/xe-gen12` `gate`)

U-23: Live Linux on <internal-name> as a measuring instrument (GPU)

What: a live Linux from a USB stick on <internal-name>, started by the owner, for phase P0 of docs/GPU-ACCELERATION.md (open question L-1): power numbers (RAPL, RC6) as a yardstick, and the strace list of the GPU calls Chromium makes. Limits: no installation, internal disks are not mounted or written, nothing from it goes into EUZOS. Linux output is read by spec agents only (docs/drivers/CLEANROOM.md). Lapses after the measurement.

U-1: Microsoft Graph / Microsoft 365

Question	Answer
What	Microsoft Graph API (`sendMail`) and Exchange Online, tenant of euzos.eu; app registration `cfae18b1-…` (sandbox)
For whom / for what	Only communication from EUZOS (owner): verification mails and notices from the profile server, sender `no-reply@euzos.eu`
Where hosted	Microsoft cloud; not in the EU (owner)
Data	e-mail address of the recipient, subject and text of the mail (verification code/link); sent items are not kept (`saveToSentItems=false`)
Risk	Microsoft (US) sees the e-mail addresses and codes; outage = no verification mails; limited to one mailbox by an Application Access Policy
Alternatives	European mail service or our own mail server on EUZOS (SMTP output is already in the profile server)
Decision	Approved (owner, 22-10-2026)
Re-assessment	22-04-2027, and every 6 months after that
Phase-out plan	`mail = smtp` to a European or our own mail server; adjust SPF/DKIM/DMARC

U-2: Caddy

Question	Answer
What	Caddy 2.11, Apache-2.0, open source (Go)
For whom / for what	HTTPS front of the profile server: certificates (Let's Encrypt), TLS, path filter, log; since 26-10-2026 also of the package server `download.euzos.eu` (static files behind our own token check `forward_auth`, owner's decision)
Where	runs on our VPS in the Netherlands (TransIP); the code comes from the US (open source)
Data	sees all HTTPS traffic of the profile server unencrypted (tokens in headers)
Risk	a bug or malicious update in Caddy affects all logins
Alternatives	own TLS server (already exists, `libs/tls`) + own ACME client + own HTTP server in the profile server
Decision	under review
Phase-out plan	build our own ACME client; let the profile server do HTTPS itself; drop Caddy

U-3: Ubuntu

Question	Answer
What	Ubuntu 26.04 LTS (Canonical, UK), operating system of the VPS
For whom / for what	runs the profile server (sandbox; later production) and the package server `download.euzos.eu` (Ubuntu 26.04, <download-ip>; owner's decision 26-10-2026)
Where	VPS in the Netherlands
Data	everything on the server (database, keys)
Risk	security updates depend on Canonical; large attack surface
Alternatives	the profile server on EUZOS itself (like the workplace server, milestone 10)
Decision	Approved for now (owner, 22-10-2026), until the profile server runs on our own EUZOS server
Re-assessment	22-04-2027, and every 6 months after that
Phase-out plan	profile server as an EUZOS service; VPS with an EUZOS image

U-4: TransIP

Question	Answer
What	TransIP (Netherlands), VPS and DNS for euzos.eu
For whom / for what	hosting of the profile server; DNS
Where	Netherlands (EU)
Data	everything on the VPS; the provider can in principle access the disk
Alternatives	own hardware in a European data centre
Decision	Approved (owner, 22-10-2026)
Re-assessment	22-04-2027, and every 6 months after that

U-5: Let's Encrypt

Question	Answer
What	Let's Encrypt (ISRG, US), certificate authority
For whom / for what	certificates for `profile(.sbx).euzos.eu`, so that phones and browsers trust the server
Where	US
Data	domain names (also in public certificate transparency logs)
Alternatives	European CA (e.g. HARICA (Greece), Certigna (France)); pinned keys between EUZOS PCs (like the workplace server)
Decision	Approved for now (owner, 22-10-2026); investigate whether it can be done via a European certificate authority
Re-assessment	22-04-2027, and every 6 months after that

U-6: Rust crates of the profile server

Question	Answer
What	e.g. axum, tokio, hyper, rusqlite (with SQLite), argon2, p256, ed25519-dalek, lettre, ureq, rustls, ring, serde (see `server/profile/Cargo.lock`, ~145 crates)
For whom / for what	the profile server
Where	run on our VPS; code from open source projects worldwide
Risk	a lot of third-party code at the heart of login; supply chain
Alternatives	own HTTP server, own storage, `libs/crypto` (already has Ed25519, P-256, SHA-2, HKDF, AES-GCM; not yet Argon2)
Decision	Approved (owner, 22-10-2026)
Re-assessment	22-04-2027, and every 6 months after that
Phase-out plan	rewrite the profile server on our own libs (together with U-2/U-3: on EUZOS itself)

U-7: Flutter and plugins

Question	Answer
What	Flutter (Google, BSD), plugins mobile_scanner, app_links, flutter_secure_storage
For whom / for what	the EUZOS app on iPhone and Android
Where	runs on the user's phone
Risk	dependent on Google for the app; third-party plugins
Alternatives	own native apps: Swift (iOS) and Kotlin (Android), only with the standard libraries of Apple and Google
Decision	Approved for now (owner, 22-10-2026); investigate an alternative for the future (own native apps)
Re-assessment	22-04-2027, and every 6 months after that

U-8: Mozilla root certificates

Question	Answer
What	Mozilla's list of trusted root certificates (via curl.se), on the stick as `ROOTS.PEM`
For whom / for what	HTTPS to websites from EUZOS (`http`, `fetch`, browser, profile server)
Risk	whoever is in the list can issue certificates for any site
Alternatives	our own, smaller list (e.g. only European CAs + Let's Encrypt), own management
Decision	Approved (owner, 22-10-2026); investigate whether it can be done differently (own root list)
Re-assessment	22-04-2027, and every 6 months after that

U-9: Inter

Question	Answer
What	typeface Inter 4.1 (SIL OFL 1.1)
For whom / for what	text on the desktop and in the app
Risk	none (data, not code)
Alternatives	own typeface
Decision	Approved (owner, 22-10-2026): free licence
Re-assessment	22-04-2027, and every 6 months after that

U-10: Broadcom firmware

Question	Answer
What	firmware for the BCM43241 wifi chip of the VAIO, and for the CYW43455 wifi chip of the Raspberry Pi 4/5/CM4/CM5 (runs on the chip itself)
For whom / for what	wifi on the VAIO and the Raspberry Pi
Files (CYW43455)	`firmware/cyw43455/`: from RPi-Distro/firmware-nonfree commit `c91cd2804cf7` (`debian/config/brcm80211/`), licence binary-redist-Cypress (Cypress/Infineon EULA, object code, for use with Cypress chips; `firmware/cyw43455/copyright`); SHA-256 in `docs/drivers/specs/rpi-wifi.md` §5
Risk	closed code on the chip, with access to the wifi traffic
Alternatives	choose hardware with open firmware for EUZOS PCs
Decision	Approved (owner, 22-10-2026); depends on the hardware. Extended to the CYW43455 (owner, 30-10-2026)
Re-assessment	22-04-2027, and every 6 months after that

U-11: GitHub

Question	Answer
What	GitHub (Microsoft, US), the project's private repository
For whom / for what	storage and history of the source code
Where	US
Risk	the source code is held by an American party
Alternatives	European hosting (e.g. Codeberg (Germany), own Forgejo/Gitea server)
Decision	Approved (owner, 22-10-2026)
Re-assessment	22-04-2027, and every 6 months after that
Phase-out plan	mirror or move the repository to European hosting (Codeberg, or our own Forgejo server); no secrets in the repository (stays that way)

U-12: Build tools

Question	Answer
What	Rust compiler and Cargo, Zig (Linux build of the server), Xcode and Android SDK (phone app), macOS on the development Mac
For whom / for what	only for building; does not run in EUZOS itself
Risk	a compromised compiler can influence everything
Alternatives	reproducible builds, later building on EUZOS itself
Decision	Approved (owner, 22-10-2026)
Re-assessment	22-04-2027, and every 6 months after that

U-13: NTP pool

Question	Answer
What	`pool.ntp.org` (volunteers worldwide)
For whom / for what	the time on EUZOS PCs (needed for certificates)
Risk	a wrong time (EUZOS already checks limits and two servers)
Alternatives	own or European time servers (e.g. via the profile server or the workplace server, signed)
Decision	Approved (owner, 22-10-2026)
Re-assessment	22-04-2027, and every 6 months after that

U-14: Servo (app engine)

Question	Answer
What	Servo, browser engine in Rust (MPL-2.0), managed by Linux Foundation Europe
For whom / for what	the app engine for web apps (milestone 9) and the engine for heavy websites in the EUZOS browser; only in userland, as an isolated process per app
Where	runs on the EUZOS PC; the project is managed in Europe
Data	the content of apps and websites (within the app's process)
Risk	millions of lines of external code; contained because every app is its own isolated process with only approved permissions
Alternatives	own app engine (own browser engine + own JavaScript engine): years of work
Decision	Approved for now (owner, 22-10-2026); look at it again in 6 months
Re-assessment	22-04-2027, and every 6 months after that
Phase-out plan	our own browser engine (`libs/web`) keeps growing; when it is sufficient, replace Servo

Also to decide (parts of Servo that do not come from Europe): Servo uses SpiderMonkey (Mozilla's JavaScript engine, US, MPL-2.0) and needs a C library; the plan is musl (MIT, international open source project). Without these two Servo does not run. Decision (owner, 22-10-2026): yes, SpiderMonkey and musl fall under this exception, only as part of Servo. Other use (e.g. musl for other programs) is a separate exception. The alternative for musl remains relibc (in Rust, from Redox OS) and later our own code.

U-15: Intel firmware for wifi chips (iwlwifi)

Question	Answer
What	firmware for Intel wifi chips (e.g. Wireless 7260/7265/8260/8265, 9000 series incl. the 9461/9462/9560 CNVi, AX200/AX201/AX210/AX211, with the PNVM radio data file where the chip needs it), from the `linux-firmware` archive (`iwlwifi-<chip>-<version>.ucode`); runs on the chip itself; on the stick as `\EOS\FW\IWL<CHIP>.UCD`
For whom / for what	wifi on PCs with an Intel wifi chip (most business laptops; first test device: Panasonic FZ-G1 with Intel 8260)
Where	runs on the wifi chip in the PC; the files come from Intel (US), distributed via kernel.org
Data	all wifi traffic passes through the chip (EUZOS does the encryption itself with its own crypto: the chip is "SoftMAC")
Risk	closed code on the chip, with access to the wifi traffic and DMA to memory (EUZOS limits DMA to its own rings; IOMMU later)
Licence	freely redistributable in unmodified form (Intel licence in `linux-firmware`); licence text included on the stick (`LICINTEL.TXT`)
Alternatives	hardware with open firmware; a USB wifi stick with a chip that EUZOS supports itself
Decision	Approved (owner, 23-10-2026), just like U-10 (Broadcom)
Re-assessment	23-04-2027, and every 6 months after that
Phase-out plan	choose hardware with open or own firmware for EUZOS PCs; pinned versions with SHA-256 in the repo (25-10-2026: `IWL8000C.UCD` and `IWL8265.UCD`; 26-10-2026 for the AX201: `IWLQUB0.UCD`, `IWLQUC0.UCD`, `IWLQUZA0.UCD`, linux-firmware tag `20260916`, API 77; 27-10-2026 for the same Qu/QuZ CNVi with the Jf radio (Wireless-AC 9461/9462/9560, the HP turned out to have this one): `IWLQUB0J.UCD`, `IWLQUC0J.UCD`, `IWLQUZAJ.UCD` (`iwlwifi-Qu--jf-b0-77`, same tag, identical on git.kernel.org and the GitLab mirror), approved by the owner on 27-10-2026 (new files under this exception); since 27-10-2026 all in `firmware/` and on the stick; all in `libs/iwl` `FIRMWARE`; 27-10-2026 for the Wi-Fi 6E AX211* (So MAC + Gf radio, PCI `8086:51F0`, HP ProBook 450 G9): `IWLSOGF.UCD` = `iwlwifi-so-a0-gf-a0-77.ucode` (linux-firmware tag `20260916`, byte-identical in `20221109`; 1,641,260 bytes, sha256 `87590ea9535a8939fddb296bc7622f3a900f28f47b45cb4e435a2a1d5f496ccd`; API 77, build `core74_pv::f92b5fed`) and `IWLSOGF.PNV` = `iwlwifi-so-a0-gf-a0.pnvm` (radio data, PNVM, of the same firmware release: tag `20221109`, 42,092 bytes, sha256 `a8154f03c8ac8534d630bf3def288d894da3dabe71d982cbfa878fb52130eb77`); both identical on git.kernel.org and the GitLab mirror, approved by the owner on 27-10-2026 (new files under this exception; spec `docs/drivers/specs/intel-so-gen3.md` §5); the firmware gets no wifi keys (EUZOS encrypts itself, `docs/WIFI-INTEL.md`); 30-10-2026, Intel Bluetooth firmware (owner approved, same exception): `firmware/ibt/` from linux-firmware tag `20260916` (licence `LICENSES/LICENCE.ibt_firmware`, redistributable, copied to `firmware/ibt/LICENCE.ibt_firmware`): `ibt-0040-0041.sfi` (Solar, ProBook 450 G9 / AX211; 720,988 bytes, sha256 `8dcfb3a7c1592c11c3e80505d21ee78dbde3de0c830d8e3e856371c37717b62c`), `ibt-19-0-4.sfi` (Harrison Peak, AX201 / Jf CNVi; 801,412 bytes, sha256 `2e6a2027b9eeb3aa94255f10752bb828077739104b8be6769c7500322edddfd6`), and the identical 9-byte `.ddc` files (sha256 `fe272982577efdc289cfe3e8bedafca607c0b7d6c9df1aab1880e22ef930d077`); spec `docs/drivers/specs/bluetooth.md` §5; 30-10-2026, extended by the owner for USB `8087:0aaa` (Wireless-AC 9560/9462, the HP test PC; same tag `20260916`, same licence): `ibt-17-16-1.sfi` (Jefferson Peak, legacy generation variant `0x11` revision 16, release `BT_Pulsar_REL20425_22.20.2412.20425`; 675,500 bytes, sha256 `a0604a0685a322e0ab2c3bd019bf862498c7b2b440ca6f515e0c8d7f849ac517`; its `.ddc` is the same 9-byte file as above), `ibt-17-0-1.sfi` (revision 0, `BT_JeffersonPeak_A0_B0_REL0201`; 625,216 bytes, sha256 `43f033a45d3e594ca135eba95774d7e15ab7f5f868eecc20e14724cb9200a4cd`) and `ibt-17-0-1.ddc` (14 bytes, sha256 `a251dac7382530032a8e74460edc5e22212437f70c5f57be101fb19e637aa5a8`), the two names the legacy file-name rule can give for variant `0x11`; in `fwbt` as `IBTJFP16.SFI`, `IBTJFP0.SFI`, `IBTJFP0.DDC`. (The HP's `8087:0aaa` itself answered Read Version with variant `0x13` revision 32, i.e. `ibt-19-32-0`, which was already pinned as a link name of `ibt-19-0-4`.)

U-16: Chromium (full browser as an app)

Question	Answer
What	Chromium, the open source basis of Chrome and Microsoft Edge (BSD and other free licences), without Google services (no Google account, sync, Safe Browsing calls, telemetry or updater)
For whom / for what	web apps that require a full browser: Microsoft Teams and Microsoft 365 online (the most important for customers), YouTube and other heavy sites
Where	runs on the EUZOS PC as an approved app in an isolated container via the Linux layer (milestone 9); not part of EUZOS itself
Data	everything the user does in the browser; cookies and storage only in RAM / in the profile ("nothing local")
Risk	tens of millions of lines of external code (Google, US); contained by the container (own address space, only granted permissions: network, sound, camera/microphone on request) and by building out the Google services
Alternatives	Firefox (Mozilla, US; less tested by Microsoft for Teams); Servo (European, U-14) and our own browser: cannot handle Teams for the next few years
Decision	Approved (owner, 23-10-2026)
Re-assessment	23-04-2027, and every 6 months after that
Phase-out plan	our own browser (`libs/web`) and Servo (U-14) keep growing; as soon as they can handle Teams/Microsoft 365, replace Chromium
Addendum (owner, 23-10-2026)	Source: the ready-made Linux build (x86-64) of ungoogled-chromium (open project, Chromium without Google services and telemetry), pinned with SHA-256 and, where the project offers it, a signature; build it ourselves later. Included in the package, under this exception: the libraries Chromium needs (glibc with the dynamic loader `ld-linux-x86-64.so.2`, NSS/NSPR, fontconfig/freetype, and whatever else the build requires); every library with version and SHA-256 in the package manifest. Agreements on how it runs: `CHROMIUM.md`, "Agreements" ("Afspraken").

U-17: Ubuntu on the FZ-G1 as a measuring instrument (iwlwifi tracepoints)

Question	Answer
What	the Ubuntu installation already on the SSD of the Panasonic FZ-G1; boot it once to read out the `iwlwifi_io` tracepoints of the Linux wifi driver (built into Ubuntu; nothing is installed or downloaded)
For whom / for what	our own Intel wifi driver (`kernel/src/net/iwl/`, docs/WIFI-INTEL.md): record the register sequence up to the firmware's "ALIVE" notification, as a reference for the behaviour; no Linux code goes into EUZOS
Where	locally on the FZ-G1; the measurement file goes to the Mac via a USB stick and is not put in git if it contains data that does not belong there
Data	only register values of the wifi chip; wifi is off in NetworkManager (no connection, no password); the tracepoints of commands (`iwlwifi`, possibly with keys) stay off
Risk	none: read only; the SSD is not modified (except the measurement file in the home folder)
Alternatives	keep searching the documentation without a measurement (slow; ten causes already ruled out)
Decision	Approved (owner, 23-10-2026), once
Re-assessment	lapses after the measurement
Phase-out plan	n/a (once)

U-18: Realtek firmware for USB wifi sticks (RTL8188SU/RTL8191SU)

Question	Answer
What	Realtek firmware `rtl8712u.bin` for USB wifi sticks with the RTL8188SU/RTL8191SU/RTL8192SU (RTL8712 family), from the `linux-firmware` archive, pinned with SHA-256; runs on the stick itself; on the boot stick as `\EOS\FW\RTL8712U.BIN`
For whom / for what	temporary wifi via a USB stick on PCs whose built-in wifi chip does not work yet (FZ-G1, HP); first test device: TP-Link TL-WN723N v1 (`0bda:8171`), of which the owner has many
Where	runs on the chip in the USB stick; the file comes from Realtek (Taiwan), distributed via kernel.org
Data	all wifi traffic passes through the stick (the firmware does scanning and connecting); the firmware gets no keys: EUZOS does the 4-way handshake and the encryption (CCMP) itself, so the stick only sees encrypted data (`docs/WIFI-USB.md`)
Risk	closed code on the stick with access to the wifi traffic; the stick can only talk to EUZOS via our own USB buffers (no DMA into the PC's memory, unlike PCIe)
Licence	freely redistributable in unmodified form (Realtek licence in `linux-firmware`, LICENCE.rtlwifi_firmware.txt); licence text included on the stick
Alternatives	the built-in wifi chip (Intel, U-15) as soon as that driver works; sticks with open firmware (Atheros AR9271)
Decision	Approved (owner, 23-10-2026)
Re-assessment	23-04-2027, and every 6 months after that
Phase-out plan	as soon as the built-in wifi chips of the EUZOS PCs work, only as an emergency solution
Details	linux-firmware tag `20240909`, `rtlwifi/rtl8712u.bin`, sha256 `6e84ec69c300b0182c9bc8fa41e88281eeb04013c4a34c341748052c3c6a9d3d`, identical on git.kernel.org and the GitLab mirror; in the repo as `firmware/RTL8712U.BIN`, licence `firmware/LICENTIE-REALTEK-WIFI.txt` (on the stick `\EOS\LICRTL.TXT`). The driver refuses any other file (fixed sha256).

U-19: Test tools on the Mac

Question	Answer
What	software that only runs on the development Mac, as a yardstick when testing: ACPICA (`iasl -d`, `acpiexec`; built locally, in `tools/amltest/compare.py`), Python 3 with python-qrcode (QR reference), headless Chrome (reference renders for WebP, SVG and the browser); approved by the owner (24-10-2026, explorer): the built-in macOS disk programs `hdiutil`, `newfs_exfat`, `newfs_msdos`, `fsck_exfat` and `fsck_msdos` (`tools/exfat-test.sh`: create and check FAT32 and exFAT images as files; never on a real disk); admin tools (26-10-2026): PowerShell with the ExchangeOnlineManagement module, only to manage the access policy of the mail apps (EUZOS sbx/prod) in our own Microsoft 365 tenant
For whom / for what	compare our own AML reader, QR codes, image formats and layout with a known implementation
Where	only on the owner's Mac; never in EUZOS, on the stick, in an image or on a server
Data	test input from the repo and the ACPI tables of our own test devices; nothing from users
Risk	small: runs locally, output only serves as a comparison; no code goes into EUZOS (see `SOURCES.md` for the knowledge used this way)
Alternatives	own reference implementations (more work, the same bugs possible on both sides)
Decision	Approved (owner, 23-10-2026)
Re-assessment	23-04-2027, and every 6 months after that
Phase-out plan	n/a (tools); new test tools are added here before use

U-20: Microsoft 365 / Graph for the user's mail and files

Question	Answer
What	Microsoft Graph (mail, OneDrive, SharePoint) and signing in with Microsoft Entra ID (device code, RFC 8628), via our own app registration "EUZOS" (public client, multi-tenant). Extended 26-10-2026 (under review): also signing in to the EUZOS PC with the work account (docs/WORK-LOGIN.md): the ID token (OpenID Connect) goes to our own profile server, which checks it with Microsoft's public keys (JWKS) and occasionally refreshes the refresh token from the vault at Microsoft to detect offboarding
For whom / for what	users with a Microsoft 365 account: their own mail in the mail app and their files in the explorer (docs/MAIL.md); and employees of an organisation (`org-create`/`org-tenant`/`org-domain`) who sign in to the PC with their work account. Different from U-1 (the mail from EUZOS)
Where	Microsoft cloud of the user's organisation; not always in the EU
Data	when signing in to the PC: Microsoft sees that the user signs in to the EUZOS app (it already sees that with mail); the profile server stores `tid` and `oid` (link) and the address as account name, never the ID token. Further: the user's mail and files (which are already there); on the PC only in RAM, wiped on logout; tokens on the PC only in RAM. The refresh token is stored encrypted in the vault of our own profile server (VPS in the Netherlands, ChaCha20-Poly1305 under a server key in a separate file, bound per account; docs/PROFILE-PROTOCOL.md "The vault" ("De kluis")), so that mail and OneDrive link automatically after login. Nothing goes to Microsoft that Microsoft did not already issue
Risk	dependent on Microsoft; the user or their organisation has chosen Microsoft, EUZOS sends nothing extra. New with the vault: whoever gets hold of the profile server and the key file can decrypt the refresh tokens and so reach the users' mail and files (until Microsoft or the user revokes them). Limited by: key outside the database and outside git (600/640), associated data per account, only with a pc token of that account, throttling, vault log; later option C (add the phone's key)
Alternatives	IMAP/SMTP to any (European) mail provider: is in the same app. Without the vault (key file removed): a new device code on every PC
Decision	approved (owner, 24-10-2026); tokens encrypted on our own profile server: approved (owner, 24-10-2026, option B; option C follows)
Re-assessment	24-04-2027, and every 6 months after that
Phase-out plan	n/a as long as users have Microsoft 365; IMAP/SMTP remains the route to other providers

U-21: Let's Encrypt ACME service for the Web server package

Question	Answer
What	the ACME service (RFC 8555) of Let's Encrypt (ISRG, US): production `acme-v02.api.letsencrypt.org` and staging `acme-staging-v02.api.letsencrypt.org`. Only the service: the ACME client, the JWS signing, the CSR and the HTTP/TLS stack are our own code (`libs/webserver`, `kernel/src/server/webserver/acme.rs`); no external code
For whom / for what	the Web server package of EUZOS Server (docs/PACKAGE-WEBSERVER.md): automatic certificates for the sites the admin adds with `cert=acme`, so that browsers trust them. Different from U-5 (the certificates of our own profile server, obtained by Caddy)
Where hosted / where does it run	the service runs at Let's Encrypt (US); the client runs on the EUZOS Server of the customer; not in the EU
Which data	the domain names of the customer's sites (also public in the certificate transparency logs), the public account key and certificate keys, the CSR, optionally a contact e-mail address of the admin (`acme-email`, not required); Let's Encrypt sees the server's public IP address. The private keys never leave the server (encrypted area on partition 2)
Dependency and risk	without the service no new or renewed certificates (the old one keeps working until it expires; renewal starts 30 days before); a US party can refuse or revoke certificates; mitigated by manual upload (`cert=upload`), back-off and rate-limit safe retries, staging for tests
Alternatives	a European ACME CA (e.g. HARICA (Greece), or another CA with an ACME endpoint: the client is standard RFC 8555, only the directory URL changes); certificates uploaded by hand (already supported)
Decision	Approved by owner 27-10-2026, only for using the Let's Encrypt ACME service; no external code
Re-assessment	27-04-2027, and every 6 months after that
Phase-out plan	add the directory URL of a European ACME CA as a choice in `WEB.TXT` (`acme=`), and make it the default when one is available; manual upload remains

U-22: Raspberry Pi GPU firmware and device trees (approved 29-10-2026)

Status: proposed (29-10-2026), not approved. Until the owner approves it, no Raspberry Pi file is committed to the repository and no release contains one: make image-rpi refuses to build without RPI_FW_DIR, a local directory the owner downloaded himself, and copies the files from there into the developer's own build/eos-rpi.img (RASPBERRY-PI.md §8). The Pi 3 files (bootcode.bin, start.elf, fixup.dat) are no longer part of the proposal (Pi 3 dropped, owner 29-10-2026).

Question	Answer
What	Raspberry Pi boot firmware, Raspberry Pi Ltd (Cambridge, UK) / Broadcom: `start4.elf`, `fixup4.dat` and their variants (`start4x/cd/db`, Pi 4 / 400 / CM4), the EEPROM bootloader already in every Pi 4/5 (and its recovery image), the TF-A BL31 inside the Pi 5 EEPROM, and the board device trees `bcm2711-.dtb` and `bcm2712.dtb`; `LICENCE.broadcom` alongside. Source: the official release (github.com/raspberrypi/firmware, `boot/`), version pinned and hashed in the image build once approved. Licence: Raspberry Pi/Broadcom firmware licence (binary redistribution, for use with Raspberry Pi devices); DTBs GPL-2.0 or dual GPL-2.0/BSD, shipped as separate data files, never linked into EUZOS code
For whom / for what	only the Raspberry Pi image `eos-rpi.img` (Pi 4, Pi 400, CM4, Pi 5): starting the SoC, DRAM, clocks, loading PIBOOT and the bundle, and describing the board (DTB). After PIBOOT, EUZOS only calls the firmware through the mailbox property interface (framebuffer, later clocks/power/tryboot) and PSCI on the Pi 5
Where hosted / where does it run	on the Pi itself: the VideoCore GPU (and EL3 on the Pi 5); local, no service, no network
Which data	none leaves the device; the firmware can read all RAM and the boot media
Dependency and risk	unavoidable: no Raspberry Pi starts without it. Closed code with full system access, running before EUZOS; Raspberry Pi Ltd controls updates (EEPROM updates via the official recovery image)
Alternatives	none for the boot firmware on Raspberry Pi hardware. DTBs: an own minimal EUZOS DTB per board (own code, 2-3 agent-days) can replace the shipped DTBs (decision D3). edk2 and U-Boot were rejected (RASPBERRY-PI.md §3)
Decision	proposed, not approved (29-10-2026)
Re-assessment	6 months after approval
Phase-out plan	DTBs: own DTB. Firmware: not possible on Raspberry Pi hardware; the long-term alternative is ARM boards with open firmware (TF-A + own UEFI)