1. Where components ship
| Delivery | What it is | How it reaches you |
|---|---|---|
| Portal | The web portal that runs in your browser | Served by the Forge portal over HTTPS |
| Service | The Forge portal gateway, operations, boot, migration and publishing applications running in Microsoft Azure | Not distributed; runs on Asterio's hosting. Listed for transparency |
| Network boot | The firmware loader, iPXE program and Windows PE boot files that a device downloads when it starts over the network | Served by the Forge boot service over HTTP (first loader stage) and HTTPS |
| WinPE media | The x64 and ARM64 Windows PE boot media (ISO and USB) and the Windows PE image used by network boot | Published by Asterio; written to USB or mounted as ISO by the customer |
| Cache installer | The Forge Cache Windows installer (MSI) with the Forge Cache service and the Forge Cache Setup application | Downloaded from the portal's Site delivery page |
| Delivered content | Windows installation images and manufacturer driver packs that Forge delivers to a device during an approved deployment | Downloaded by the device from Forge, a site cache or a peer |
2. Component inventory
The inventory was taken from the source repository on 5 October 2026: the package references and restored dependency graphs of every shipped project (src/**/*.csproj, obj/project.assets.json), the vendored portal script (src/Forge.Web/wwwroot/vendor), the media build scripts (scripts/media), the installer build (scripts/release, .config/dotnet-tools.json) and the dated production records in docs/. Test-only packages are not shipped and are not listed.
| Component | Version | Licence | Copyright holder | Ships in |
|---|---|---|---|---|
Microsoft Authentication Library for JavaScript (@azure/msal-browser) | 5.22.0 | MIT | Microsoft Corporation | Portal |
| .NET runtime and ASP.NET Core shared framework | 10.0 | MIT | .NET Foundation and Contributors | Service (supplied by Azure App Service, not redistributed by Asterio); Cache installer (self-contained); WinPE media (self-contained peer worker Forge.Cache.exe) |
| .NET Windows Desktop runtime (Windows Forms) | 10.0 | MIT | .NET Foundation and Contributors | Cache installer (Forge Cache Setup) |
Azure SDK for .NET (Azure.Core, Azure.Identity, Azure.Security.KeyVault.Keys, Azure.Storage.Blobs, Azure.Storage.Common, System.ClientModel, System.Memory.Data) | Azure.Core 1.55.0; Azure.Identity 1.21.0; Azure.Security.KeyVault.Keys 4.10.1; Azure.Storage.Blobs 12.29.2; Azure.Storage.Common 12.28.0; System.ClientModel 1.11.0; System.Memory.Data 10.0.3 | MIT | Microsoft Corporation | Service |
Microsoft Authentication Library for .NET (Microsoft.Identity.Client, Microsoft.Identity.Client.Extensions.Msal, Microsoft.Identity.Client.Broker) | 4.83.1, 4.84.2; Extensions.Msal 4.83.1; Broker 4.84.2 | MIT | Microsoft Corporation | Service; Cache installer (Forge Cache Setup sign-in, Microsoft.Identity.Client 4.84.2) |
| Microsoft.Identity.Client.NativeInterop | 0.20.6 | Microsoft Software License Terms (proprietary, redistributable in binary form) | Microsoft Corporation | Service (managed interop assembly brought in by Microsoft.Data.SqlClient for Windows broker sign-in; not used on the Linux hosts) |
Microsoft IdentityModel (Microsoft.IdentityModel.Abstractions, JsonWebTokens, Logging, Protocols, Protocols.OpenIdConnect, Tokens, Validators, System.IdentityModel.Tokens.Jwt) | 7.7.1, 8.14.0, 8.19.2 | MIT | Microsoft Corporation | Service; Cache installer (Microsoft.IdentityModel.Abstractions 8.14.0) |
| Microsoft.AspNetCore.Authentication.JwtBearer | 10.0.11 | MIT | Microsoft Corporation | Service |
Entity Framework Core (Microsoft.EntityFrameworkCore, .Abstractions, .Relational, .Sqlite, .Sqlite.Core, .SqlServer, Microsoft.Data.Sqlite.Core) | 10.0.11 | MIT | Microsoft Corporation | Service |
| Microsoft.Data.SqlClient and Microsoft.SqlServer.Server | 6.1.6; 1.0.0 | MIT | Microsoft Corporation | Service |
SQLitePCLRaw (SQLitePCLRaw.core, SQLitePCLRaw.provider.e_sqlite3, SQLitePCLRaw.lib.e_sqlite3, SQLitePCLRaw.bundle_e_sqlite3) | 2.1.12 | Apache License 2.0 | SourceGear, LLC (Eric Sink) | Service (SQLite provider for Entity Framework Core) |
| SQLite | The native build bundled in SQLitePCLRaw.lib.e_sqlite3 2.1.12 (libe_sqlite3.so) | Public domain | The SQLite authors (dedicated to the public domain) | Service |
Microsoft.Extensions libraries (Caching.Abstractions, Caching.Memory, Configuration and its Abstractions, Binder, CommandLine, EnvironmentVariables, FileExtensions, Json, UserSecrets, DependencyInjection and .Abstractions, DependencyModel, Diagnostics and .Abstractions, FileProviders.Abstractions, FileProviders.Physical, FileSystemGlobbing, Hosting, Hosting.Abstractions, Hosting.WindowsServices, Logging and its Abstractions, Configuration, Console, Debug, EventLog, EventSource, Options, Options.ConfigurationExtensions, Primitives) | 8.0.0, 10.0.0, 10.0.3, 10.0.11 | MIT | Microsoft Corporation | Service; Cache installer; WinPE media (peer worker) |
.NET platform extension packages (Microsoft.Bcl.AsyncInterfaces, Microsoft.Bcl.Cryptography, System.Configuration.ConfigurationManager, System.Diagnostics.EventLog, System.IO.Hashing, System.Security.Cryptography.Pkcs, System.Security.Cryptography.ProtectedData, System.ServiceProcess.ServiceController) | AsyncInterfaces 10.0.3; Bcl.Cryptography 10.0.2; ConfigurationManager 9.0.11; EventLog 9.0.11; IO.Hashing 10.0.3; Pkcs 9.0.11; ProtectedData 4.5.0, 9.0.11, 10.0.0; ServiceController 10.0.0 | MIT | .NET Foundation and Contributors; Microsoft Corporation | Service; Cache installer (ProtectedData 10.0.0, ServiceController 10.0.0); WinPE media (peer worker) |
| WiX Toolset custom action libraries and WixUI common dialogs (Firewall, Util and UI extensions) | 5.0.2 | Microsoft Reciprocal License (MS-RL) | .NET Foundation and contributors | Cache installer (embedded in the MSI for the service's firewall rules, service failure actions, data folder removal and the installer dialogs; the WiX Toolset itself is a build tool and is not shipped) |
| shim (the iPXE project's build of the UEFI shim, Microsoft-signed) | ipxe-16.1 (source commit d0367b25d04ec90d332909b99d932571f15e5a06), unmodified | BSD 2-Clause (the shim COPYRIGHT file); the binary embeds OpenSSL and EDK II code under their own permissive licences | Red Hat, Inc. and the shim contributors; Intel Corporation (EDK II portions); the OpenSSL Project | Network boot (snponly-shim.efi, ipxe-shim.efi for x64 and ARM64) |
| iPXE (official signed distribution) | v2.0.0 (source commit 12798ec29aa8a64d8675c4378b99f5fe28447afb), unmodified | GNU General Public License, version 2 or later; individual files carry their own declarations, including the Unmodified Binary Distribution Licence (UBDL) and BSD-style licences, as described in the iPXE COPYING file | Michael Brown and the iPXE contributors | Network boot (ipxe.efi, snponly.efi for x64 and ARM64) |
| wimboot (Windows Imaging Format bootloader) | v2.9.0, unmodified | GNU General Public License, version 2 or later | Michael Brown | Network boot (wimboot.efi for x64 and ARM64) |
Microsoft Windows Preinstallation Environment (Windows PE) with the optional components WinPE-WMI, WinPE-NetFX, WinPE-Scripting, WinPE-PowerShell, WinPE-StorageWMI and WinPE-DismCmdlets, the boot manager, boot.sdi and the BCD store | Windows PE 10.0.26100 from the Windows Assessment and Deployment Kit 10.1.26100.9457 (Windows PE add-on) | Microsoft Software License Terms for the Windows Assessment and Deployment Kit (Windows PE redistribution terms) | Microsoft Corporation | WinPE media; Network boot (boot.wim, boot.sdi, BCD) |
| Windows PowerShell 5.1 (part of WinPE-PowerShell) | 5.1 | Microsoft Software License Terms (part of Windows PE) | Microsoft Corporation | WinPE media (runs the Forge client) |
| CMTrace log viewer (optional) | The copy supplied by the build host, verified against Microsoft's signature | Microsoft Software License Terms (Microsoft Configuration Manager tools) | Microsoft Corporation | WinPE media, only when the build host adds it; Asterio does not redistribute CMTrace otherwise |
| Manufacturer and hypervisor Windows PE boot drivers: Dell WinPE 11 driver pack A10, HP WinPE driver pack 3.40, Lenovo WinPE driver package 01 (ThinkPad L14 Gen 6 and L16 Gen 2), Microsoft Surface WinPE HID driver 3.97.22.0 and Surface driver dependencies, VMware VMXNET3 1.9.20.0 and VMware USB mouse 12.5.15.0 (ARM64), Parallels NetKVM 100.0.2.0 | As stated, unmodified and signed by their publishers; the build record of each media release lists the exact packs | Each publisher's driver licence terms | Dell Technologies; HP Inc.; Lenovo; Microsoft Corporation; Broadcom Inc. (VMware); Parallels International GmbH | WinPE media (staged under X:\Forge\Drivers and injected into the installed Windows of matching devices) |
| Microsoft Windows 11 Pro installation images | Windows 11 version 25H2, x64 and ARM64, prepared from Microsoft's official installation media | Microsoft Software License Terms for Windows; the customer must hold a licence for each device | Microsoft Corporation | Delivered content |
| Manufacturer model driver packs (HP, Dell, Lenovo, Microsoft Surface) | The manufacturer's catalog entry and version, repackaged unmodified as a WIM archive on Asterio's build host | Each manufacturer's driver licence terms | HP Inc.; Dell Technologies; Lenovo; Microsoft Corporation | Delivered content |
Forge's own code (the portal, services, Windows PE client scripts, peer worker, cache service and setup application, installer definitions and build scripts) is copyright Asterio Group AB and is licensed to customers under the Terms of Service.
3. Used to build or operate Forge but not shipped
| Component | Version | Licence | Copyright holder | Role |
|---|---|---|---|---|
WiX Toolset (wix .NET tool) | 5.0.2 | Microsoft Reciprocal License (MS-RL) | .NET Foundation and contributors | Builds the cache installer MSI on the build host |
| AzureSignTool | 7.0.1 | MIT | Kevin Jones | Signs the cache installer and its executables from Azure Key Vault on the build host |
| Windows Assessment and Deployment Kit, Deployment Tools (DISM, oscdimg, copype, MakeWinPEMedia) | 10.1.26100.9457 | Microsoft Software License Terms for the Windows ADK | Microsoft Corporation | Builds the Windows PE media on the build host |
| Driver Automation Tool | 10.2.9 (commit 449bdcb3b24f9057391f03f703f3097aa75cd320) | Its own licence as published by its author | Maurice Daly | Prepares manufacturer driver packs as WIM archives on the build host; its code is never shipped or executed on a device or in the service |
| Microsoft.Data.SqlClient.SNI.runtime | 6.0.2 | Microsoft Software License Terms (proprietary) | Microsoft Corporation | Windows-only native library restored with Microsoft.Data.SqlClient; excluded from the Linux publish and not shipped |
| Microsoft.EntityFrameworkCore.Analyzers | 10.0.11 | MIT | Microsoft Corporation | Compile-time analyzer; not shipped |
| Forge custom iPXE firmware build | iPXE source commit 744cdb451ef28bc894df72b6b40fdf1fda04acfc with Forge patches | GNU General Public License, version 2 or later | Michael Brown and the iPXE contributors; patches Asterio Group AB | Archived build candidate; not published to any device. Its corresponding source archive is retained with the build record |
Microsoft Office Deployment Tool (setup.exe) | 16.0.20326.20112 | Microsoft Software License Terms | Microsoft Corporation | Downloaded by the device directly from Microsoft when the customer enables Microsoft 365 Apps; Forge verifies it but does not redistribute it |
4. Licences
MIT License
The following applies to the components listed above under the MIT licence, with the copyright holder named in the table:
MIT License. Copyright (c) the copyright holder. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Apache License 2.0
SQLitePCLRaw is licensed under the Apache License, Version 2.0. The licence text is included in each SQLitePCLRaw package and is available from the Apache Software Foundation. Asterio distributes the libraries unmodified.
Microsoft Reciprocal License (MS-RL)
The WiX Toolset custom action libraries and WixUI common dialogs embedded in the Forge Cache installer are licensed under the Microsoft Reciprocal License. Asterio distributes them unmodified in binary form inside the installer. The licence text is included in the WiX Toolset distribution and is available from the .NET Foundation.
GNU General Public License (iPXE and wimboot)
iPXE and wimboot are free software licensed under the GNU General Public License, version 2 (GPLv2), or at your option any later version. Forge serves the official, unmodified, signed binaries from the iPXE project to your devices during network boot. Under the terms of the GPL you may copy, distribute and modify these programs; they come with no warranty beyond what the licence states.
Licence text. The full text of the GNU General Public License, version 2, is included as the file COPYING.GPLv2 in the iPXE source tree and in the wimboot source tree at the commits named above, together with iPXE's COPYING and COPYING.UBDL files that describe the per-file declarations. Asterio provides a copy of the licence text together with the corresponding source code described below, and on request by e-mail.
Written offer of corresponding source code. Asterio Group AB hereby offers to any third party who receives these binaries from Forge, for a period of three years from the date on which Asterio last distributed the binary, a complete machine-readable copy of the corresponding source code of iPXE v2.0.0 (source commit 12798ec29aa8a64d8675c4378b99f5fe28447afb) and wimboot v2.9.0, together with the licence files and the exact build identities Forge publishes (file names and SHA-256 digests of the served binaries), for a charge no more than Asterio's cost of physically performing the distribution. Send your request to forge@asterio.se or to Asterio Group AB, Ekebovägen 14, 663 32 Skoghall, Sweden, stating "Forge GPL source request". The same source code is published by the iPXE project at the commits named above; Asterio does not modify the served binaries. Should Asterio ever publish a modified build (such as the archived custom firmware build listed in section 3), the written offer extends to that build's complete corresponding source, including Asterio's patches and build configuration, which Forge archives with each build record.
Microsoft components
Windows Preinstallation Environment, the Windows installation images, Windows PowerShell and the optional CMTrace viewer are Microsoft software. Asterio distributes Windows PE under the redistribution terms of the Windows Assessment and Deployment Kit, and delivers Windows installation images only to devices of customers who are responsible for holding a Windows licence for each device (see the Terms of Service). The Microsoft Authentication Library, the Azure SDK, Entity Framework Core, Microsoft.Data.SqlClient, the IdentityModel libraries and the .NET platform are open source under the MIT licence. Microsoft.Identity.Client.NativeInterop is distributed in binary form under Microsoft's software licence terms as a dependency of Microsoft.Data.SqlClient; Forge does not use the Windows broker it supports.
Driver packs
Windows PE boot drivers and model driver packs are redistributed unmodified from the manufacturers' published, signed packages, with the manufacturers' catalog identity and digest recorded. They remain subject to the terms under which Dell Technologies, HP Inc., Lenovo, Microsoft Corporation, Broadcom Inc. (VMware) and Parallels International GmbH publish their drivers for installation on their hardware or hypervisors. Forge installs them only on matching devices.
5. Questions
Questions about these notices, and requests for source code, licence texts or corrections to the inventory, go to forge@asterio.se. Asterio updates this page with each release that changes a shipped component.
Inventory date 5 October 2026. Version 1.0. Effective 9 October 2026.