What third-party software the delivered products contain, and what tools build and verify them. Scope and method follow REQUIREMENTS.dox (the tool-installation reference): versions are taken from the projects' own build files or observed on the reference development host, never guessed, and each row names where to re-check it. Snapshot date: 2026-10-07. The EN 50128 context is the safety and quality plan, section 3 (tool classes, tier rules); the pinning gaps listed in section 4 below are tracked in TODO.dox and ISSUES.dox.

1. Shipped third-party components (part of a delivered product)

The C products are deliberately thin on third-party code: the vital tier (Platform_RTE, Platform_OS_POSIX, RBC_GP/GA/SA, Platform_Protocol_SafeComm/KM114/KM038) links no third-party library at all beyond the C runtime and the POSIX API of the host OS. Cryptography used by the vital tier (3DES/CBC-MAC for KM114/KM038, the SaF MAC) is implemented inside those products' own sources, not taken from OpenSSL.

Component	Version constraint	Used by	Linkage	Licence	Re-check
C runtime + POSIX (libc, pthread, sockets, clock_gettime)	host OS	every C product, through Platform_OS_POSIX behind the OSA seams	dynamic (system)	system	platform/os_adapters/Platform_OS_POSIX
OpenSSL (libssl, libcrypto)	>= 3.0; builds against 3.x and 4.x (verified 3.6.5 and 4.0.3 on 2026-10-07)	RBC_Maintenance_Web only (TLS, client-certificate auth, update signatures) - runs inside RBC_GP's role-C Gateway process	dynamic	Apache-2.0	application/RBC_Maintenance_Web/CMakeLists.txt:21
Python standard library	Python >= 3.9	RBC_Test_Sim_Core/Train/IL/CTC, RBC_Test_CommServer (tooling tier, not vital)	interpreter	PSF	pyproject.toml of each: no third-party dependencies entries

2. Build and verification tools (EN 50128 class T2/T3, not shipped)

The authoritative installation list with per-tool "why" is REQUIREMENTS.dox; this table records the versions in use on the reference host and in CI for the assessment record.

Tool	Version in use	Role	Re-check
CMake	>= 3.16 (required)	build system of every C product	cmake_minimum_required in each CMakeLists.txt
AppleClang	21.0 (macOS host)	compiler, macOS development builds	cc --version
gcc	12.2 (osa-build:bookworm container, Docker images)	compiler, Linux/Release builds	container gcc --version
cppcheck + MISRA addon	2.21/2.22 observed	MISRA C:2012 screening (reports state the exact version per run)	docs/MISRA_COMPLIANCE_REPORT.dox of each C product
Doxygen	1.18.0	documentation build (known to crash at random; reruns, see root CLAUDE.md)	doxygen --version
gcovr/gcov	host version	coverage of Platform_RTE (RTE_ENABLE_COVERAGE)	platform/Platform_RTE/CMakeLists.txt:76
Python	3.14 (robot venv)	test environment, web runner, generators	test/RBC_Test_Env/robot/.venv
Robot Framework	>=7.0 (unpinned)	system test suites	test/RBC_Test_Env/robot/requirements.txt
Docker + compose	host version	containerised test stack and Linux builds	docker --version
Conan	2.x (optional path)	alternative package-manager build of every product	root CLAUDE.md, Conan table

3. Container base images

Image	Used by	Pinned?
debian:bookworm-slim	RBC A/B/C runtime and build stages (application/RBC_SA/Dockerfile), RBC_Test_CommServer, the osa-build build container	tag only, not by digest
python:3.12-slim	simulator images (each src/Dockerfile under test/simulators/)	tag only, not by digest

4. Pinning status and known supply-chain risks

Homebrew OpenSSL moves underneath the build. 2026-10-07, twice in one day: the removal of an old openssl@3 keg broke the cached CMake configure of RBC_Maintenance_Web, and the arrival of openssl@4 (4.0.3) as the default broke the -Werror compile through an API deprecation (X509_NAME_get_text_by_NID). Both fixed the same day: the code now uses the non-deprecated X509 name API and builds against OpenSSL 3.x and 4.x; pinned build directories use the version-stable /opt/homebrew/opt/openssl@3 prefix. Rule going forward: RBC_Maintenance_Web must keep building against the two current OpenSSL major lines.
Unpinned base images and test-framework version. debian:bookworm-slim, python:3.12-slim and robotframework>=7.0 float; a rebuild on another day is not bit-identical and a Docker Hub outage degrades sim-image rebuilds silently (ISSUES.dox ISS-023). The reproducibility item in TODO.dox ("pin versions and digests") covers this.
Tool qualification. The T2 tools above have no qualification reports yet; tracked in the safety and quality plan (section 3.3) and its gap list.
Conan adds a network-fetched cache to the build chain when used; the plan's assessment note in root CLAUDE.md applies. The plain dist/ path has no network dependency at build time.