Third Party Notices - Interpretative Note and Disclaimer

Automatically generated Third Party Notice reports from SAS are intended to be as complete and accurate as possible. However, SAS cannot guarantee that these reports are without error or omission. For many components, supplementary artifacts (such as notice files, source code, or repository links) are embedded in or otherwise delivered with SAS software.

SAS uses an industry-leading Software Composition Analysis tool to identify third-party components in our applications. The tool scans source code, looking for matches against an industry-leading database of open-source project, license, and security information. The process is subject to the following limitations:

• SAS cannot guarantee that the database is perfectly accurate. To the extent there may be incomplete or inaccurate information in the database, Third Party Notice reports from SAS might inherit that incomplete or inaccurate information. For example, the database might identify a component as subject to an open-source license even though the same component is alternatively available under a commercial license.
• SAS cannot guarantee that the Source Code Analysis (SCA) performed is perfectly accurate. To the extent the scanning tool identifies false positives, Third Party Notice reports from SAS might list open-source components that do not necessarily appear in the relevant SAS software or any other SAS software. To the extent the scanning tool fails to identify an open-source component (a false negative), Third Party Notice reports from SAS might not reflect those components.

Source code for open-source components that are leveraged by SAS software is managed as follows:

• The vast majority, if not all, of these components are used by SAS in unmodified form.
  
• The vast majority, if not all, of these components are available from repositories such as SourceForge or GitHub, or from other publicly accessible sites easily located through an internet search for the project name.
  
• For certain components, direct links to repositories and source code are included in Third Party Notice reports or delivered with SAS software.