Skip to main content

Credits

This page lists the third-party software, services, fonts, and standards Makenotwork is built on, along with their licenses and homepages. Only direct dependencies are enumerated; transitive dependencies (the dependencies of our dependencies) run into the hundreds and aren’t listed here. Makenotwork itself ships under PolyForm Noncommercial 1.0.0.

Primary dependencies

Tokio

Asynchronous runtime; every other Rust dependency on this list assumes it. Originally designed by Carl Lerche. MIT.

Axum

HTTP framework. A thin layer over tower, hyper, and tokio. Maintained as part of the Tokio project. MIT.

sqlx

Async PostgreSQL driver with compile-time query checking. MIT or Apache-2.0.

PostgreSQL

The database. Free, open-source, ~30 years of community maintenance. PostgreSQL License (permissive).

aws-sdk-s3

S3 protocol client. We point it at Hetzner Object Storage. Maintained by AWS. Apache-2.0.

async-stripe

Rust wrapper around Stripe’s API. Maintained by Alex Whiting. MIT or Apache-2.0.

YARA-X

Malware-pattern scanner. Rust rewrite of YARA, from the VirusTotal team. BSD-3-Clause.

ClamAV

Virus scanner. We talk to it over INSTREAM. Maintained by Cisco Talos. GPL-2.0.

Askama

Templates compiled into Rust at build time; typos become compile errors. MIT or Apache-2.0.

git2 / libgit2

Rust bindings to libgit2; backs every push, browse, and smart-HTTP serve under /source. GPL-2.0 with linking exception.

argon2 and webauthn-rs

Password hashing (argon2, OWASP-recommended) and passkey login (webauthn-rs, by William Brown of SUSE). MIT or Apache-2.0.

Rust crates (direct dependencies)

Licenses noted in parentheses where they aren’t the standard MIT/Apache-2.0 dual.

HTTP and middleware: axum, axum-extra, tower, tower-http, tower-sessions, tower-sessions-sqlx-store, tower_governor, http-body-util, utoipa, utoipa-axum.

Database: sqlx, chrono.

Storage: aws-sdk-s3, aws-config, fs2, memmap2, tempfile, bytes.

Scanning and binary analysis: yara-x (BSD-3-Clause), infer, object, goblin, authenticode, apple-codesign (MPL-2.0), zip, x509-cert, x509-parser, asn1-rs, const-oid.

Payments: the async-stripe family (async-stripe, async-stripe-billing, async-stripe-checkout, async-stripe-connect, async-stripe-core, async-stripe-payment, async-stripe-product, async-stripe-shared, async-stripe-types).

Auth and crypto: argon2, webauthn-rs, webauthn-rs-proto, webauthn-authenticator-rs, jsonwebtoken, hmac, sha1, sha2, totp-rs, chacha20poly1305, subtle, rand, zeroize, aes.

Templating and markup: askama, pulldown-cmark, syntect, ammonia, regex, regex-lite, unicode-normalization.

HTTP client: reqwest, hickory-resolver, webpki-roots, rustls-pki-types, tokio-rustls.

Serialization: serde, serde_json, toml, base64, hex, url, urlencoding, email_address, semver, uuid.

Async: tokio, tokio-stream, tokio-util, async-trait, dashmap, parking_lot, governor.

Git: git2 (and through it, libgit2, GPL-2.0 with linking exception).

Observability: tracing, tracing-subscriber, metrics, metrics-exporter-prometheus, log.

Errors: anyhow, thiserror.

CLI and TUI (mnw-cli, sando-tui, wam): clap, ratatui, crossterm, russh, russh-sftp, dirs.

MCP: rmcp.

Testing: proptest, wiremock, tempfile, criterion, fast-tests.

Transitive dependencies are not enumerated; see cargo tree for the full set.

Other software

  • PostgreSQL: database (PostgreSQL License).
  • ClamAV: virus scanner (GPL-2.0).
  • Caddy: reverse proxy and TLS (Apache-2.0).

Services

Fonts

All served from Google Fonts under the Open Font License.

  • Young Serif (Bunny Studio)
  • IBM Plex Mono (IBM)
  • Lato (Łukasz Dziedzic)

Standards

  • HTTP/1.1, HTTP/2 (IETF)
  • WebAuthn Level 3 (W3C / FIDO Alliance)
  • TOTP (RFC 6238)
  • OAuth 2.0 + PKCE (IETF)
  • S3 API (AWS)
  • YARA rule syntax (VirusTotal)

Did we miss you?

If your project or service is in the list above and we got the description wrong, or if you maintain something we depend on and don’t see your name here, email us at info@makenot.work and we’ll fix it.