# Software Composition Analysis ## Identification Software composition analysis identifies third-party components, licenses, versions, and known signatures within a software artifact. ## Notebook evidence - [[Scanned_20260730-1806#Page 3 — `Scanned_20260730-1806.pdf`, PDF page 3|PDF page 3]] — “The Dagger Authors” as dependency/license residue. - [[Scanned_20260730-1806#Page 18 — `Scanned_20260730-1806.pdf`, PDF page 18|PDF page 18]] — JSR 305/GWT resource and source-tree metadata inside an APK. - [[Scanned_20260730-1806#Page 24 — `Scanned_20260730-1806.pdf`, PDF page 24|PDF page 24]] — ClassyShark3xodus, manifests, classes, trackers, and certificate-oriented inspection. ## Boundary An embedded resource may be transitive, generated, unused, or retained as packaging residue. Presence does not prove that the application actively executes the component or communicates with a related service. ## Relationships [[Software Bill of Materials]] · [[Package Provenance]] · [[Dagger Dependency Injection]] · [[JSR 305]] · [[Google Web Toolkit]].