CSI baseline CSI-IFX-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.
Informix4GL Demo: component inventory
In this document
Dated baseline: 22 October 2026 · Eight declared component records
What the inventory represents
This inventory records the dependency and environment declarations available in the retained documentation. A filename gives a useful version clue; it does not attest the identity, contents, patches or execution of a deployed binary. The inventory therefore carries the declaration and the missing evidence together. IFX-S-C10 IFX-S-E0014
The eight records are a bounded inventory, rather than a complete software bill of materials. Transitive dependencies, packaged operating-system components and the effective deployment have not been enumerated. The exact source revision analysed by the retained documentation is also unbound. IFX-S-PROVENANCE IFX-S-C10
Declared components
| Component | Recorded declaration | Documented role | Identity or use still to establish |
|---|---|---|---|
| iText | itext-2.1.7.jar; candidate Maven identity com.lowagie:itext |
Java launch dependency; possible reporting dependency | Jar hash, manifest, package coordinates, patch/fork provenance and actual callers. The link to the report framework is unresolved. |
| SwingX | swingx-all-1.6.4.jar |
Desktop user-interface dependency associated with Swing-style forms | Exact package identity, binary contents and relevant transitive dependencies. |
| Informix JDBC driver | ifxjdbc.jar; driver class com.informix.jdbc.IfxDriver |
Database access to the demonstration database | Driver version, distribution, deployed binary and compatibility with the selected server and Java runtime. |
| jfclix application framework | jfclix.jar; no version recorded |
Application, UI, database and reporting framework boundary | Exact framework release and implementations of report, database, error-handling and monetary behaviour. |
| Informix installer target | ibm.ids.14.10.FC5.LNX.tar |
One documented Linux database installation route | Installed server version, edition, platform, patch provenance and whether this route is used. |
| Database container | ibmcom/informix-developer-database:latest |
Alternative documented database setup route | Immutable digest, image contents and server version. The tag alone cannot bind the baseline to one build. |
| Java runtime | java launcher |
Executes the Java application; relevant vendor tools may have separate requirements | Distribution, JRE/JDK version, effective executable and relationship to any installer or tooling Java requirement. |
| Development base image | gitpod/workspace-full-vnc |
Development desktop environment | Immutable image identity and installed packages. A development declaration is not evidence of a production environment. |
Sources: IFX-S-C07 IFX-S-C08 IFX-S-C10 IFX-S-E0014.
Declarations that must remain separate
The FC5 archive and the mutable database image are two documented setup routes. Neither proves which server a user actually ran. The FC5-specific rejection of CVE-2021-20515 therefore applies to the declared archive target; it cannot be transferred to the unknown image or a live server without inventory evidence. IFX-S-E0014 IFX-S-IBM-20515
The Java launch declaration does not identify the Java distribution or version. It also does not show whether the Java environment used by server installation tools is the same environment used by the desktop application. IBM's later packaging requirements need to be checked against the precise target rather than against the presence of a generic java command. IFX-S-C10 IFX-S-IBM-JRE
Similarly, jfclix.jar is a named framework boundary, not an inventory of everything it contains or calls. The report lifecycle is described in retained evidence, but an iText dependency inside that lifecycle has not been demonstrated. Counting the three named report callers as affected by iText would skip that missing relationship. IFX-S-E0012 IFX-S-E0014
How much matching the current inventory supports
| Inventory surface | Matching available at the baseline | Consequence for the assessment |
|---|---|---|
| iText 2.1.7 declaration | Vendor family lifecycle and a precise candidate advisory range | Supports IFX-F-001 and IFX-F-002 with separate identity and reachability qualifications. |
| Informix FC5 archive | Vendor fix-level comparison | Supports IFX-F-004's declared-target rejection. |
| Informix upgrade target | No target selected | IFX-F-003 remains conditional. |
| SwingX 1.6.4 declaration | Bounded searches established no applicable authoritative finding | Preserve the search outcome without treating it as proof of support or safety. |
| JDBC, framework, Java and mutable images | Exact versions or immutable identities missing | Precise advisory and lifecycle matching remains blocked. |
Sources: IFX-S-ITEXT-EOL IFX-S-XXE IFX-S-IBM-20515 IFX-S-IBM-JRE IFX-S-C10 IFX-S-E0014. The evidence report summarises the bounded SwingX coverage and its non-result.
Evidence to collect next
IFX-V-001 should bind each record to a named build or environment. Record the source revision and build identifier; capture artifact hashes and manifests; identify any fork or vendor patch; record server edition and fix pack; pin container digests; and identify the Java, JDBC and framework versions actually used. Store effective configuration separately with sensitive values removed from any public result. IFX-S-PROVENANCE IFX-S-C10 IFX-S-E0014
The inventory is ready for a later finding update when a reviewer can trace a declared component to an exact artifact and environment. Any component that cannot yet be bound should remain explicitly unknown. IFX-V-002 then addresses the separate question of how iText is used. IFX-S-E0012
This Wayfinder CSI assessment is limited to the registered source set. Findings, inference, recommendations and evidence gaps remain distinct. It does not establish a completed migration, production suitability or functional equivalence.
Independent Harten analysis of the Informix4GL Demo source material. No maintainer endorsement is implied. The exact analysed upstream revision remains unbound. The source records do not establish runtime behaviour or equivalence between the 4GL and Java implementations.
Inspect the evidence and external lookups · Read the existing application documentation edition.