> For the complete documentation index, see [llms.txt](https://support.powerio.com/hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.powerio.com/hub/security/security-en/software-supply-chain/codesys-und-libraries.md).

# CODESYS and Libraries

CODESYS is an optionally installable, commercial control platform. The powerIO Libraries for CODESYS are provided as compiled, signed files.

## CODESYS Security

CODESYS supports encrypted engineering communication via `CmpSecureChannel`, controller certificates, device users with groups and object-based access rights, as well as signed or encrypted boot applications. For WebVisu, HTTPS is possible, provided the Runtime supports this and is configured accordingly.

Which methods are actually used depends on Runtime version, components, certificates and Security Policies. A binding statement requires checking the installed Runtime and the respective project.

## Signature and SBOM of the Libraries

Each current powerIO Library is provided as a signed file in the CODESYS format (`.compiled-library-v3`). The signature is created with an X.509 code-signing certificate and proves publisher and integrity; it does not encrypt the Library. The respective download page states the signature status and a signed Library hash. This hash is the first twelve characters of the SHA-256 value of the signed file and serves as an integrity indicator, not as a signature or certificate indicator.

An SBOM in the format <code class="expression">space.vars.sbom\_format</code> documents the components and dependencies contained in a Library. It is a basis for vulnerability management and CRA documentation, but neither a signature nor proof that no vulnerabilities are present.

<details>

<summary>Version reference and coverage</summary>

An SBOM always relates to a specific Library version. Older releases and other Libraries may have a different status. Therefore, the security information on the respective download page is authoritative.

</details>

## BACnet SL license

BACnet/IP via CODESYS requires the [HVAC BACnet2 Library](/hub/codesys-hvac/en/hvac-bacnet2-library/beschreibung.md) and a separate [CODESYS BACnet SL license](https://store.codesys.com/en/codesys-bacnet-sl.html) as a single-device license. The security classification of the BMS protocols can be found under [Network and BMS communication](/hub/security/security-en/operation/netzwerk-und-bms.md).

## Further sources

* [CODESYS: Encrypted controller communication and Security Policy](https://content.helpme-codesys.com/en/Security/_sec_encrypting_communication_changing_security_policy.html)
* [CODESYS: Device user management](https://content.helpme-codesys.com/en/Security/_sec_user_management_plc.html)
* [CODESYS: Supported cryptography interfaces](https://content.helpme-codesys.com/en/libs/CmpCrypto%20Interfaces/Current/CmpCrypto-Interfaces/Enums/RtsCryptoID.html)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://support.powerio.com/hub/security/security-en/software-supply-chain/codesys-und-libraries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.