0.9.0 (#56)
* fix tagging
* fixed headers and license
* removed conifg files
* WARN removed
---------
Co-authored-by: Michele Sciabarra <michele@sciabarra.com>
Co-authored-by: Build OpenServerless <noreply@example.com>
diff --git a/.env.dist b/.env.dist
index 0036e31..0ef9b4a 100644
--- a/.env.dist
+++ b/.env.dist
@@ -1,3 +1,21 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
# github user, used to derive the default local image name
GITHUB_USER=github: put here your github user
diff --git a/.env.example b/.env.example
index f73cbe6..cab7938 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,22 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+
LISTEN_PORT=5000
COUCHDB_SERVICE_PORT=5984
COUCHDB_SERVICE_HOST=host.docker.internal
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 235cba8..b13c865 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -49,23 +49,19 @@
# Manual run: create a new snapshot tag on the current HEAD and push it.
# The push of the tag does not start another run (GITHUB_TOKEN pushes do
# not trigger workflows), so this same run goes on and builds it.
- - name: Tag HEAD (manual run)
+ - name: License
+ uses: apache/skywalking-eyes@v0.9.0
+ - name: Assign TAG from manual run
if: ${{ github.event_name == 'workflow_dispatch' }}
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
task tag
task ci
- - name: License
- uses: apache/skywalking-eyes@v0.9.0
- - name: Assign TAG from pull request
- if: ${{ github.event_name == 'pull_request' }}
- run: |
- echo "IMG_TAG=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
- - name: Assign TAG from push
- if: ${{ github.event_name != 'pull_request' }}
- run: |
echo "IMG_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV"
+ - name: Assign TAG from push
+ if: ${{ github.event_name == 'push' }}
+ run: echo "IMG_TAG=${{ github.ref_name }}" >> "$GITHUB_ENV"
- name: Generate .env
run: |
OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
diff --git a/.licenserc.yaml b/.licenserc.yaml
index a1a9eff..10e7037 100644
--- a/.licenserc.yaml
+++ b/.licenserc.yaml
@@ -21,19 +21,19 @@
copyright-owner: Apache Software Foundation
paths-ignore:
- - '**/*.sample'
- - 'env.example'
- - '.git-hooks/pre-commit'
- - '**/_*'
+ #- '**/*.sample'
+ #- 'env.example'
+ #- '.git-hooks/pre-commit'
+ #- '**/_*'
- 'LICENSE'
- 'NOTICE'
- 'DISCLAIMER'
- - 'WARN'
- - 'deploy/samples/*'
- - '**/*.json'
- - '**/*.service'
- - '**/*.txt'
- - 'uv.lock'
- - '.env.example'
- - '.env.dist'
- - '.vscode/*.json'
+ - 'WARN'
+ #- 'deploy/samples/*'
+ #- '**/*.json'
+ #- '**/*.service'
+ #- '**/*.txt'
+ #- 'uv.lock'
+ #- '.env.example'
+ #- '.env.dist'
+ # - '.vscode/*.json'
diff --git a/.vscode/launch.json b/.vscode/launch.json
deleted file mode 100644
index d2420eb..0000000
--- a/.vscode/launch.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
- "version": "0.2.0",
- "configurations": [
- {
- "name": "Debug OpenServerless Admin API",
- "type": "debugpy",
- "request": "launch",
- "module": "openserverless",
- "preLaunchTask": "Start Port Forwards",
- "postDebugTask": "Stop Port Forwards"
- }
-
- ]
-}
\ No newline at end of file
diff --git a/.vscode/start-port-forwards.sh b/.vscode/start-port-forwards.sh
deleted file mode 100755
index 6126b5d..0000000
--- a/.vscode/start-port-forwards.sh
+++ /dev/null
@@ -1,60 +0,0 @@
-#!/bin/bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-set -e
-
-# Log start time for debugging
-echo "$(date): Starting port forwards..." >> /tmp/pf-start.log
-
-# Clean up any existing port forwards first
-pkill -f 'kubectl port-forward -n openserverless registry-0' 2>/dev/null || true
-pkill -f 'kubectl -n openserverless port-forward couchdb-0' 2>/dev/null || true
-rm -f /tmp/pf-registry.pid /tmp/pf-couchdb.pid /tmp/pf-registry.log /tmp/pf-couchdb.log
-sleep 1
-
-# Start port forwards in background with nohup to detach from terminal
-nohup kubectl port-forward -n openserverless registry-0 5000:5000 > /tmp/pf-registry.log 2>&1 &
-REGISTRY_PID=$!
-echo $REGISTRY_PID > /tmp/pf-registry.pid
-echo "$(date): Registry PID: $REGISTRY_PID" >> /tmp/pf-start.log
-
-nohup kubectl -n openserverless port-forward couchdb-0 5984:5984 > /tmp/pf-couchdb.log 2>&1 &
-COUCHDB_PID=$!
-echo $COUCHDB_PID > /tmp/pf-couchdb.pid
-echo "$(date): CouchDB PID: $COUCHDB_PID" >> /tmp/pf-start.log
-
-# Disown the processes so they don't get killed when the script exits
-disown -a
-
-# Wait a moment for port forwards to establish
-sleep 2
-
-# Verify processes are still running
-if ps -p $REGISTRY_PID > /dev/null 2>&1; then
- echo "$(date): Registry port-forward is running" >> /tmp/pf-start.log
-else
- echo "$(date): WARNING: Registry port-forward died!" >> /tmp/pf-start.log
-fi
-
-if ps -p $COUCHDB_PID > /dev/null 2>&1; then
- echo "$(date): CouchDB port-forward is running" >> /tmp/pf-start.log
-else
- echo "$(date): WARNING: CouchDB port-forward died!" >> /tmp/pf-start.log
-fi
-
-echo "Port forwards started: registry=$REGISTRY_PID, couchdb=$COUCHDB_PID"
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
deleted file mode 100644
index 50a531d..0000000
--- a/.vscode/tasks.json
+++ /dev/null
@@ -1,48 +0,0 @@
-{
- "version": "2.0.0",
- "tasks": [
- {
- "label": "Start Port Forwards",
- "type": "shell",
- "command": "${workspaceFolder}/.vscode/start-port-forwards.sh",
- "isBackground": true,
- "problemMatcher": {
- "pattern": {
- "regexp": "^Port forwards started: (.*)$",
- "message": 1
- },
- "background": {
- "activeOnStart": true,
- "beginsPattern": "^.*$",
- "endsPattern": "^Port forwards started:.*$"
- }
- },
- "presentation": {
- "echo": false,
- "reveal": "never",
- "focus": false,
- "panel": "shared",
- "showReuseMessage": false,
- "clear": false
- }
- },
- {
- "label": "Stop Port Forwards",
- "type": "shell",
- "command": "test -f /tmp/pf-registry.pid && kill $(cat /tmp/pf-registry.pid) 2>/dev/null; test -f /tmp/pf-couchdb.pid && kill $(cat /tmp/pf-couchdb.pid) 2>/dev/null; rm -f /tmp/pf-registry.pid /tmp/pf-registry.log /tmp/pf-couchdb.pid /tmp/pf-couchdb.log; pkill -f 'kubectl port-forward -n openserverless registry-0' 2>/dev/null; pkill -f 'kubectl -n openserverless port-forward couchdb-0' 2>/dev/null; echo 'Port forwards stopped'; exit 0",
- "presentation": {
- "echo": true,
- "reveal": "silent",
- "focus": false,
- "panel": "dedicated",
- "showReuseMessage": false
- },
- "options": {
- "shell": {
- "executable": "/bin/bash",
- "args": ["-c"]
- }
- }
- }
- ]
-}
diff --git a/.vscode/test-task.sh b/.vscode/test-task.sh
deleted file mode 100755
index 14ffff2..0000000
--- a/.vscode/test-task.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-echo "Testing from VSCode task..."
-echo "PATH: $PATH"
-echo "SHELL: $SHELL"
-echo "PWD: $PWD"
-which kubectl
-kubectl version --client --short 2>/dev/null || kubectl version --client 2>/dev/null
diff --git a/Dockerfile b/Dockerfile
index 43daf63..cff4f28 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -43,7 +43,7 @@
USER openserverless
RUN uv venv && uv pip install --requirement pyproject.toml
-# Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN)
+# Apache release metadata (see DISCLAIMER, LICENSE, NOTICE)
COPY DISCLAIMER LICENSE NOTICE /
ENV HOME=/home/openserverless
diff --git a/LICENSE b/LICENSE
index a4f0e08..b0c40bf 100644
--- a/LICENSE
+++ b/LICENSE
@@ -200,228 +200,674 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
+---------------
+
+The Apache source release of Apache OpenServerless consists of
+Apache-2.0 licensed files only, and the license above applies to all of
+it. The sections below apply to third-party software bundled in the
+container image built from the Dockerfile beside this file
+(docker.io/apache/openserverless-admin-api), which is a convenience
+binary assembled at build time. See the WARN file for the ASF
+category classification of each license.
+---------------
+
+The container image contains the following components which were
+released under an Apache 2.0 license, the text of which is reproduced
+above.
+
+ * aiohttp (3.14.3) -- Apache-2.0 AND MIT
+ * aiosignal (1.4.0)
+ * bcrypt (5.0.0)
+ * frozenlist (1.8.0)
+ * minio (7.1.13)
+ * multidict (6.7.0)
+ * propcache (0.4.1)
+ * requests (2.32.5)
+ * uv (installed via pip) -- Apache-2.0 OR MIT
+ * yarl (1.22.0)
+ * cryptography (50.0.0) -- Apache-2.0 OR BSD-3-Clause
+ * packaging (25.0) -- Apache-2.0 OR BSD-2-Clause
+---------------
+
+The container image contains the following components which were
+released under an MIT license.
+
+ * aiohttp (3.14.3), in part, and its vendored copy of llhttp
+ * attrs (25.4.0)
+ * auth0-python (4.13.0)
+ * backoff (2.2.1)
+ * blinker (1.9.0)
+ * charset-normalizer (3.4.4)
+ * flasgger (0.9.7.1)
+ * flask-cors (6.0.1)
+ * jsonschema (4.25.1)
+ * jsonschema-specifications (2025.9.1)
+ * pyjwt (2.13.0)
+ * pyyaml (6.0.3)
+ * redis (7.1.0)
+ * referencing (0.37.0)
+ * rpds-py (0.30.0)
+ * six (1.17.0)
+ * urllib3 (2.7.0)
+ * uv (installed via pip) -- Apache-2.0 OR MIT
+
+The MIT-licensed components above carry the following copyright
+notices:
+
+ attrs Copyright (c) 2015 Hynek Schlawack and the attrs contributors
+ auth0-python Copyright (c) 2017 Auth0, Inc. <support@auth0.com> (http://auth0.com)
+ backoff Copyright (c) 2014 litl, LLC.
+ blinker Copyright 2010 Jason Kirtland
+ charset-normalizer Copyright (c) 2025 TAHRI Ahmed R.
+ flasgger Copyright (c) 2014 Bruno Rocha
+ jsonschema Copyright (c) 2013 Julian Berman
+ jsonschema-specifications Copyright (c) 2022 Julian Berman
+ llhttp (vendored) Copyright (c) 2018 Fedor Indutny
+ pyjwt Copyright (c) 2015-2022 José Padilla
+ pyyaml Copyright (c) 2006-2016 Kirill Simonov
+ Copyright (c) 2017-2021 Ingy döt Net
+ redis Copyright (c) 2022-2023, Redis, inc.
+ referencing Copyright (c) 2022 Julian Berman
+ rpds-py Copyright (c) 2023 Julian Berman
+ six Copyright (c) 2010-2024 Benjamin Peterson
+ urllib3 Copyright (c) 2008-2020 Andrey Petrov and contributors
+
+The MIT license text, as distributed with attrs, is:
+
+The MIT License (MIT)
+
+Copyright (c) 2015 Hynek Schlawack and the attrs contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+---------------
+
+The container image contains cffi (2.0.0), which was released under
+the MIT No Attribution license.
-==============================================================================
-BEGIN BUNDLED THIRD-PARTY SOFTWARE INVENTORY (container image)
-==============================================================================
+Except when otherwise stated (look for LICENSE files in directories or
+information at the beginning of each file) all software and
+documentation is licensed as follows:
-==============================================================================
-LICENSES OF BUNDLED THIRD-PARTY SOFTWARE
-Container image: apache/openserverless-admin-api
-==============================================================================
+ MIT No Attribution
-Apache OpenServerless itself is licensed under the Apache License,
-Version 2.0, reproduced above. The container image built from the
-Dockerfile beside this file additionally bundles the third-party
-components listed below, each under its own license.
+ Permission is hereby granted, free of charge, to any person
+ obtaining a copy of this software and associated documentation
+ files (the "Software"), to deal in the Software without
+ restriction, including without limitation the rights to use,
+ copy, modify, merge, publish, distribute, sublicense, and/or
+ sell copies of the Software, and to permit persons to whom the
+ Software is furnished to do so.
-Refer to https://www.apache.org/legal/resolved.html for the ASF
-classification of these licenses. Components that are NOT compatible
-with the Apache License 2.0 are enumerated in the WARN file.
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ DEALINGS IN THE SOFTWARE.
+---------------
-------------------------------------------------------------------------------
-Summary by license
-------------------------------------------------------------------------------
+The container image contains the following components which were
+released under a 3-clause BSD license.
-Apache-2.0
- aiosignal (1.4.0)
- asttokens (3.0.1)
- bcrypt (5.0.0)
- frozenlist (1.8.0)
- minio (7.1.13)
- multidict (6.7.0)
- propcache (0.4.1)
- requests (2.32.5)
- yarl (1.22.0)
+ * click (8.3.1)
+ * flask (3.1.2)
+ * flatdict (4.1.0)
+ * idna (3.15)
+ * itsdangerous (2.2.0)
+ * jinja2 (3.1.6)
+ * markupsafe (3.0.3)
+ * mistune (3.3.0)
+ * pycparser (2.23)
+ * python-dotenv (1.2.2)
+ * werkzeug (3.1.4)
+ * cryptography (50.0.0) -- Apache-2.0 OR BSD-3-Clause
-Apache-2.0 AND MIT
- aiohttp (3.14.3)
+The 3-clause-BSD-licensed components above carry the following
+copyright notices:
-Apache-2.0 OR BSD-2-Clause
- packaging (25.0)
+ click Copyright 2014 Pallets
+ cryptography Copyright (c) Individual contributors.
+ flask Copyright 2010 Pallets
+ flatdict Copyright (c) 2013-2020 Gavin M. Roy
+ idna Copyright (c) 2013-2026, Kim Davies and contributors.
+ itsdangerous Copyright 2011 Pallets
+ jinja2 Copyright 2007 Pallets
+ markupsafe Copyright 2010 Pallets
+ mistune Copyright (c) 2014, Hsiaoming Yang
+ pycparser Copyright (c) 2008-2022, Eli Bendersky
+ python-dotenv Copyright (c) 2014, Saurabh Kumar (python-dotenv),
+ 2013, Ted Tieken (django-dotenv-rw),
+ 2013, Jacob Kaplan-Moss (django-dotenv)
+ werkzeug Copyright 2007 Pallets
-Apache-2.0 OR BSD-3-Clause
- cryptography (50.0.0)
+The 3-clause BSD license text, as distributed with click, is:
-Apache-2.0 OR MIT
- uv (latest)
+Copyright 2014 Pallets
-BSD-2-Clause
- decorator (5.2.1)
- pygments (2.19.2)
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
-BSD-3-Clause
- click (8.3.1)
- colorama (0.4.6)
- flask (3.1.2)
- flatdict (4.1.0)
- idna (3.15)
- ipython (9.8.0)
- ipython-pygments-lexers (1.1.1)
- itsdangerous (2.2.0)
- jinja2 (3.1.6)
- markupsafe (3.0.3)
- matplotlib-inline (0.2.1)
- mistune (3.3.0)
- prompt-toolkit (3.0.52)
- pycparser (2.23)
- python-dotenv (1.2.2)
- traitlets (5.14.3)
- werkzeug (3.1.4)
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
-GPL-2.0-or-later AND BSD-3-Clause
- libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g ((Debian bookworm))
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
-ISC
- pexpect (4.9.0)
- ptyprocess (0.7.0)
+3. Neither the name of the copyright holder nor the names of its
+ contributors may be used to endorse or promote products derived from
+ this software without specific prior written permission.
-Info-ZIP
- zip, unzip ((Debian bookworm))
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+---------------
-MIT
- attrs (25.4.0)
- auth0-python (4.13.0)
- backoff (2.2.1)
- blinker (1.9.0)
- cffi (2.0.0)
- charset-normalizer (3.4.4)
- executing (2.2.1)
- flasgger (0.9.7.1)
- flask-cors (6.0.1)
- jedi (0.19.2)
- jsonschema (4.25.1)
- jsonschema-specifications (2025.9.1)
- parso (0.8.5)
- pure-eval (0.2.3)
- pyjwt (2.13.0)
- pyyaml (6.0.3)
- redis (7.1.0)
- referencing (0.37.0)
- rpds-py (0.30.0)
- six (1.17.0)
- stack-data (0.6.3)
- urllib3 (2.7.0)
- wcwidth (0.2.14)
+The container image contains packaging (25.0), which was released
+under an Apache 2.0 license (reproduced above) and a 2-clause BSD
+license, at the recipient's option.
-MPL-2.0
- certifi (2025.11.12)
+Copyright (c) Donald Stufft and individual contributors.
+All rights reserved.
-PSF-2.0
- aiohappyeyeballs (2.6.1)
- typing-extensions (4.15.0)
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
-ZPL-2.1
- waitress (3.0.2)
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
-curl (MIT-like)
- curl ((Debian bookworm))
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
-mixed; see WARN
- (see the FROM line of the Dockerfile) (-)
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+---------------
-------------------------------------------------------------------------------
-Detail by component
-------------------------------------------------------------------------------
+The container image contains the CPython runtime and standard
+library, obtained from the python:3.12-slim-bookworm base image, and the
+components aiohappyeyeballs (2.6.1) and typing-extensions (4.15.0),
+which were released under the Python Software Foundation License
+Version 2.
-Python runtime dependencies (pyproject.toml / uv.lock)
-------------------------------------------------------
- aiohappyeyeballs (2.6.1) -- PSF-2.0
- aiohttp (3.14.3) -- Apache-2.0 AND MIT
- aiosignal (1.4.0) -- Apache-2.0
- asttokens (3.0.1) -- Apache-2.0
- attrs (25.4.0) -- MIT
- auth0-python (4.13.0) -- MIT
- backoff (2.2.1) -- MIT
- bcrypt (5.0.0) -- Apache-2.0
- blinker (1.9.0) -- MIT
- certifi (2025.11.12) -- MPL-2.0
- Category B: used unmodified, as a separate file.
- cffi (2.0.0) -- MIT
- charset-normalizer (3.4.4) -- MIT
- click (8.3.1) -- BSD-3-Clause
- colorama (0.4.6) -- BSD-3-Clause
- cryptography (50.0.0) -- Apache-2.0 OR BSD-3-Clause
- decorator (5.2.1) -- BSD-2-Clause
- executing (2.2.1) -- MIT
- flasgger (0.9.7.1) -- MIT
- flask (3.1.2) -- BSD-3-Clause
- flask-cors (6.0.1) -- MIT
- flatdict (4.1.0) -- BSD-3-Clause
- frozenlist (1.8.0) -- Apache-2.0
- idna (3.15) -- BSD-3-Clause
- ipython (9.8.0) -- BSD-3-Clause
- Dev-only dependency.
- ipython-pygments-lexers (1.1.1) -- BSD-3-Clause
- Dev-only dependency.
- itsdangerous (2.2.0) -- BSD-3-Clause
- jedi (0.19.2) -- MIT
- jinja2 (3.1.6) -- BSD-3-Clause
- jsonschema (4.25.1) -- MIT
- jsonschema-specifications (2025.9.1) -- MIT
- markupsafe (3.0.3) -- BSD-3-Clause
- matplotlib-inline (0.2.1) -- BSD-3-Clause
- minio (7.1.13) -- Apache-2.0
- mistune (3.3.0) -- BSD-3-Clause
- multidict (6.7.0) -- Apache-2.0
- packaging (25.0) -- Apache-2.0 OR BSD-2-Clause
- parso (0.8.5) -- MIT
- pexpect (4.9.0) -- ISC
- prompt-toolkit (3.0.52) -- BSD-3-Clause
- propcache (0.4.1) -- Apache-2.0
- ptyprocess (0.7.0) -- ISC
- pure-eval (0.2.3) -- MIT
- pycparser (2.23) -- BSD-3-Clause
- pygments (2.19.2) -- BSD-2-Clause
- pyjwt (2.13.0) -- MIT
- python-dotenv (1.2.2) -- BSD-3-Clause
- pyyaml (6.0.3) -- MIT
- redis (7.1.0) -- MIT
- referencing (0.37.0) -- MIT
- requests (2.32.5) -- Apache-2.0
- rpds-py (0.30.0) -- MIT
- six (1.17.0) -- MIT
- stack-data (0.6.3) -- MIT
- traitlets (5.14.3) -- BSD-3-Clause
- typing-extensions (4.15.0) -- PSF-2.0
- urllib3 (2.7.0) -- MIT
- waitress (3.0.2) -- ZPL-2.1
- Category B: used unmodified, as a separate file.
- wcwidth (0.2.14) -- MIT
- werkzeug (3.1.4) -- BSD-3-Clause
- yarl (1.22.0) -- Apache-2.0
+A. HISTORY OF THE SOFTWARE
+==========================
-Operating-system packages installed by the Dockerfile
------------------------------------------------------
- uv (latest) -- Apache-2.0 OR MIT
- Python dependency manager, installed via pip.
- curl ((Debian bookworm)) -- curl (MIT-like)
- zip, unzip ((Debian bookworm)) -- Info-ZIP
+Python was created in the early 1990s by Guido van Rossum at Stichting
+Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands
+as a successor of a language called ABC. Guido remains Python's
+principal author, although it includes many contributions from others.
-Base operating system image
----------------------------
- (see the FROM line of the Dockerfile) (-) -- mixed; see WARN
- Operating-system components are supplied by the upstream base image and are not
- redistributed by the ASF in source form.
- libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g ((Debian bookworm)) -- GPL-2.0-or-later AND BSD-3-Clause
- Shipped by the upstream base image; not installed by this Dockerfile. *** SEE WARN ***
+In 1995, Guido continued his work on Python at the Corporation for
+National Research Initiatives (CNRI, see https://www.cnri.reston.va.us)
+in Reston, Virginia where he released several versions of the
+software.
-------------------------------------------------------------------------------
-Full license texts
-------------------------------------------------------------------------------
+In May 2000, Guido and the Python core development team moved to
+BeOpen.com to form the BeOpen PythonLabs team. In October of the same
+year, the PythonLabs team moved to Digital Creations, which became
+Zope Corporation. In 2001, the Python Software Foundation (PSF, see
+https://www.python.org/psf/) was formed, a non-profit organization
+created specifically to own Python-related Intellectual Property.
+Zope Corporation was a sponsoring member of the PSF.
-The complete text of the Apache License 2.0 is reproduced at the top of
-this file. The complete texts of the other licenses referenced above are
-distributed with each component inside the container image, in the
-package metadata directories of the respective package manager:
+All Python releases are Open Source (see https://opensource.org for
+the Open Source Definition). Historically, most, but not all, Python
+releases have also been GPL-compatible; the table below summarizes
+the various releases.
- * Python packages: <site-packages>/<dist>.dist-info/ (LICENSE, METADATA)
- * Node.js packages: /node_modules/<pkg>/LICENSE
- * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE
- * Go modules: vendored module sources / pkg.go.dev
- * Debian packages: /usr/share/doc/<pkg>/copyright
+ Release Derived Year Owner GPL-
+ from compatible? (1)
-==============================================================================
-END BUNDLED THIRD-PARTY SOFTWARE INVENTORY
-==============================================================================
+ 0.9.0 thru 1.2 1991-1995 CWI yes
+ 1.3 thru 1.5.2 1.2 1995-1999 CNRI yes
+ 1.6 1.5.2 2000 CNRI no
+ 2.0 1.6 2000 BeOpen.com no
+ 1.6.1 1.6 2001 CNRI yes (2)
+ 2.1 2.0+1.6.1 2001 PSF no
+ 2.0.1 2.0+1.6.1 2001 PSF yes
+ 2.1.1 2.1+2.0.1 2001 PSF yes
+ 2.1.2 2.1.1 2002 PSF yes
+ 2.1.3 2.1.2 2002 PSF yes
+ 2.2 and above 2.1.1 2001-now PSF yes
+
+Footnotes:
+
+(1) GPL-compatible doesn't mean that we're distributing Python under
+ the GPL. All Python licenses, unlike the GPL, let you distribute
+ a modified version without making your changes open source. The
+ GPL-compatible licenses make it possible to combine Python with
+ other software that is released under the GPL; the others don't.
+
+(2) According to Richard Stallman, 1.6.1 is not GPL-compatible,
+ because its license has a choice of law clause. According to
+ CNRI, however, Stallman's lawyer has told CNRI's lawyer that 1.6.1
+ is "not incompatible" with the GPL.
+
+Thanks to the many outside volunteers who have worked under Guido's
+direction to make these releases possible.
+
+
+B. TERMS AND CONDITIONS FOR ACCESSING OR OTHERWISE USING PYTHON
+===============================================================
+
+Python software and documentation are licensed under the
+Python Software Foundation License Version 2.
+
+Starting with Python 3.8.6, examples, recipes, and other code in
+the documentation are dual licensed under the PSF License Version 2
+and the Zero-Clause BSD license.
+
+Some software incorporated into Python is under different licenses.
+The licenses are listed with code falling under that license.
+
+
+PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
+--------------------------------------------
+
+1. This LICENSE AGREEMENT is between the Python Software Foundation
+("PSF"), and the Individual or Organization ("Licensee") accessing and
+otherwise using this software ("Python") in source or binary form and
+its associated documentation.
+
+2. Subject to the terms and conditions of this License Agreement, PSF hereby
+grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,
+analyze, test, perform and/or display publicly, prepare derivative works,
+distribute, and otherwise use Python alone or in any derivative version,
+provided, however, that PSF's License Agreement and PSF's notice of copyright,
+i.e., "Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
+2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Python Software Foundation;
+All Rights Reserved" are retained in Python alone or in any derivative version
+prepared by Licensee.
+
+3. In the event Licensee prepares a derivative work that is based on
+or incorporates Python or any part thereof, and wants to make
+the derivative work available to others as provided herein, then
+Licensee hereby agrees to include in any such work a brief summary of
+the changes made to Python.
+
+4. PSF is making Python available to Licensee on an "AS IS"
+basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
+IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
+DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
+FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
+INFRINGE ANY THIRD PARTY RIGHTS.
+
+5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
+FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
+A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
+OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
+
+6. This License Agreement will automatically terminate upon a material
+breach of its terms and conditions.
+
+7. Nothing in this License Agreement shall be deemed to create any
+relationship of agency, partnership, or joint venture between PSF and
+Licensee. This License Agreement does not grant permission to use PSF
+trademarks or trade name in a trademark sense to endorse or promote
+products or services of Licensee, or any third party.
+
+8. By copying, installing or otherwise using Python, Licensee
+agrees to be bound by the terms and conditions of this License
+Agreement.
+
+
+BEOPEN.COM LICENSE AGREEMENT FOR PYTHON 2.0
+-------------------------------------------
+
+BEOPEN PYTHON OPEN SOURCE LICENSE AGREEMENT VERSION 1
+
+1. This LICENSE AGREEMENT is between BeOpen.com ("BeOpen"), having an
+office at 160 Saratoga Avenue, Santa Clara, CA 95051, and the
+Individual or Organization ("Licensee") accessing and otherwise using
+this software in source or binary form and its associated
+documentation ("the Software").
+
+2. Subject to the terms and conditions of this BeOpen Python License
+Agreement, BeOpen hereby grants Licensee a non-exclusive,
+royalty-free, world-wide license to reproduce, analyze, test, perform
+and/or display publicly, prepare derivative works, distribute, and
+otherwise use the Software alone or in any derivative version,
+provided, however, that the BeOpen Python License is retained in the
+Software, alone or in any derivative version prepared by Licensee.
+
+3. BeOpen is making the Software available to Licensee on an "AS IS"
+basis. BEOPEN MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
+IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, BEOPEN MAKES NO AND
+DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
+FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE WILL NOT
+INFRINGE ANY THIRD PARTY RIGHTS.
+
+4. BEOPEN SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF THE
+SOFTWARE FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS
+AS A RESULT OF USING, MODIFYING OR DISTRIBUTING THE SOFTWARE, OR ANY
+DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
+
+5. This License Agreement will automatically terminate upon a material
+breach of its terms and conditions.
+
+6. This License Agreement shall be governed by and interpreted in all
+respects by the law of the State of California, excluding conflict of
+law provisions. Nothing in this License Agreement shall be deemed to
+create any relationship of agency, partnership, or joint venture
+between BeOpen and Licensee. This License Agreement does not grant
+permission to use BeOpen trademarks or trade names in a trademark
+sense to endorse or promote products or services of Licensee, or any
+third party. As an exception, the "BeOpen Python" logos available at
+http://www.pythonlabs.com/logos.html may be used according to the
+permissions granted on that web page.
+
+7. By copying, installing or otherwise using the software, Licensee
+agrees to be bound by the terms and conditions of this License
+Agreement.
+
+
+CNRI LICENSE AGREEMENT FOR PYTHON 1.6.1
+---------------------------------------
+
+1. This LICENSE AGREEMENT is between the Corporation for National
+Research Initiatives, having an office at 1895 Preston White Drive,
+Reston, VA 20191 ("CNRI"), and the Individual or Organization
+("Licensee") accessing and otherwise using Python 1.6.1 software in
+source or binary form and its associated documentation.
+
+2. Subject to the terms and conditions of this License Agreement, CNRI
+hereby grants Licensee a nonexclusive, royalty-free, world-wide
+license to reproduce, analyze, test, perform and/or display publicly,
+prepare derivative works, distribute, and otherwise use Python 1.6.1
+alone or in any derivative version, provided, however, that CNRI's
+License Agreement and CNRI's notice of copyright, i.e., "Copyright (c)
+1995-2001 Corporation for National Research Initiatives; All Rights
+Reserved" are retained in Python 1.6.1 alone or in any derivative
+version prepared by Licensee. Alternately, in lieu of CNRI's License
+Agreement, Licensee may substitute the following text (omitting the
+quotes): "Python 1.6.1 is made available subject to the terms and
+conditions in CNRI's License Agreement. This Agreement together with
+Python 1.6.1 may be located on the internet using the following
+unique, persistent identifier (known as a handle): 1895.22/1013. This
+Agreement may also be obtained from a proxy server on the internet
+using the following URL: http://hdl.handle.net/1895.22/1013".
+
+3. In the event Licensee prepares a derivative work that is based on
+or incorporates Python 1.6.1 or any part thereof, and wants to make
+the derivative work available to others as provided herein, then
+Licensee hereby agrees to include in any such work a brief summary of
+the changes made to Python 1.6.1.
+
+4. CNRI is making Python 1.6.1 available to Licensee on an "AS IS"
+basis. CNRI MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
+IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, CNRI MAKES NO AND
+DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
+FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 1.6.1 WILL NOT
+INFRINGE ANY THIRD PARTY RIGHTS.
+
+5. CNRI SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
+1.6.1 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
+A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 1.6.1,
+OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
+
+6. This License Agreement will automatically terminate upon a material
+breach of its terms and conditions.
+
+7. This License Agreement shall be governed by the federal
+intellectual property law of the United States, including without
+limitation the federal copyright law, and, to the extent such
+U.S. federal law does not apply, by the law of the Commonwealth of
+Virginia, excluding Virginia's conflict of law provisions.
+Notwithstanding the foregoing, with regard to derivative works based
+on Python 1.6.1 that incorporate non-separable material that was
+previously distributed under the GNU General Public License (GPL), the
+law of the Commonwealth of Virginia shall govern this License
+Agreement only as to issues arising under or with respect to
+Paragraphs 4, 5, and 7 of this License Agreement. Nothing in this
+License Agreement shall be deemed to create any relationship of
+agency, partnership, or joint venture between CNRI and Licensee. This
+License Agreement does not grant permission to use CNRI trademarks or
+trade name in a trademark sense to endorse or promote products or
+services of Licensee, or any third party.
+
+8. By clicking on the "ACCEPT" button where indicated, or by copying,
+installing or otherwise using Python 1.6.1, Licensee agrees to be
+bound by the terms and conditions of this License Agreement.
+
+ ACCEPT
+
+
+CWI LICENSE AGREEMENT FOR PYTHON 0.9.0 THROUGH 1.2
+--------------------------------------------------
+
+Copyright (c) 1991 - 1995, Stichting Mathematisch Centrum Amsterdam,
+The Netherlands. All rights reserved.
+
+Permission to use, copy, modify, and distribute this software and its
+documentation for any purpose and without fee is hereby granted,
+provided that the above copyright notice appear in all copies and that
+both that copyright notice and this permission notice appear in
+supporting documentation, and that the name of Stichting Mathematisch
+Centrum or CWI not be used in advertising or publicity pertaining to
+distribution of the software without specific, written prior
+permission.
+
+STICHTING MATHEMATISCH CENTRUM DISCLAIMS ALL WARRANTIES WITH REGARD TO
+THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS, IN NO EVENT SHALL STICHTING MATHEMATISCH CENTRUM BE LIABLE
+FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ZERO-CLAUSE BSD LICENSE FOR CODE IN THE PYTHON DOCUMENTATION
+----------------------------------------------------------------------
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+---------------
+
+The container image contains certifi (2025.11.12), which
+distributes a modified version of the Mozilla CA root certificate
+bundle under the Mozilla Public License, v. 2.0. The full text of the
+Mozilla Public License 2.0 is available at http://mozilla.org/MPL/2.0/.
+
+This package contains a modified version of ca-bundle.crt:
+
+ca-bundle.crt -- Bundle of CA Root Certificates
+
+This is a bundle of X.509 certificates of public Certificate Authorities
+(CA). These were automatically extracted from Mozilla's root certificates
+file (certdata.txt). This file can be found in the mozilla source tree:
+https://hg.mozilla.org/mozilla-central/file/tip/security/nss/lib/ckfw/builtins/certdata.txt
+It contains the certificates in PEM format and therefore
+can be directly used with curl / libcurl / php_curl, or with
+an Apache+mod_ssl webserver for SSL client authentication.
+Just configure this file as the SSLCACertificateFile.#
+
+***** BEGIN LICENSE BLOCK *****
+This Source Code Form is subject to the terms of the Mozilla Public License,
+v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain
+one at http://mozilla.org/MPL/2.0/.
+
+***** END LICENSE BLOCK *****
+@(#) $RCSfile: certdata.txt,v $ $Revision: 1.80 $ $Date: 2011/11/03 15:11:58 $
+---------------
+
+The container image contains waitress (3.0.2), which was released
+under the Zope Public License 2.1.
+
+Zope Public License (ZPL) Version 2.1
+
+A copyright notice accompanies this license document that identifies the
+copyright holders.
+
+This license has been certified as open source. It has also been designated as
+GPL compatible by the Free Software Foundation (FSF).
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions in source code must retain the accompanying copyright
+notice, this list of conditions, and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the accompanying copyright
+notice, this list of conditions, and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+3. Names of the copyright holders must not be used to endorse or promote
+products derived from this software without prior written permission from the
+copyright holders.
+
+4. The right to distribute this software or to use it for any purpose does not
+give you the right to use Servicemarks (sm) or Trademarks (tm) of the
+copyright
+holders. Use of them is covered by separate agreement with the copyright
+holders.
+
+5. If any files are modified, you must cause the modified files to carry
+prominent notices stating that you changed the files and the date of any
+change.
+
+Disclaimer
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY EXPRESSED
+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
+EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+---------------
+
+The container image contains curl, obtained from the Debian
+bookworm userland of the base image, which was released under an
+MIT-like license (the curl license).
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright (c) 1996 - 2026, Daniel Stenberg, <daniel@haxx.se>, and many
+contributors, see the THANKS file.
+
+All rights reserved.
+
+Permission to use, copy, modify, and distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright
+notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN
+NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
+OR OTHER DEALINGS IN THE SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall not
+be used in advertising or otherwise to promote the sale, use or other dealings
+in this Software without prior written authorization of the copyright holder.
+---------------
+
+The container image contains zip and unzip, obtained from the
+Debian bookworm userland of the base image, which were released under
+the Info-ZIP license.
+
+This software is provided "as is," without warranty of any kind, express
+or implied. In no event shall Info-ZIP or its contributors be held liable
+for any direct, indirect, incidental, special or consequential damages
+arising out of the use of or inability to use this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the above disclaimer and the following restrictions:
+
+ 1. Redistributions of source code (in whole or in part) must retain
+ the above copyright notice, definition, disclaimer, and this list
+ of conditions.
+
+ 2. Redistributions in binary form (compiled executables and libraries)
+ must reproduce the above copyright notice, definition, disclaimer,
+ and this list of conditions in documentation and/or other materials
+ provided with the distribution.
+
+ 3. Altered versions--including, but not limited to, ports to new operating
+ systems, existing ports with new graphical interfaces, versions with
+ modified or added functionality, and dynamic, shared, or static library
+ versions not from Info-ZIP--must be plainly marked as such and must not
+ be misrepresented as being the original source or, if binaries,
+ compiled from the original source. Such altered versions also must not
+ be misrepresented as being Info-ZIP releases--including, but not
+ limited to, labeling of the altered versions with the names "Info-ZIP"
+ (or any variation thereof, including, but not limited to, different
+ capitalizations), "Pocket UnZip," "WiZ" or "MacZip" without the
+ explicit permission of Info-ZIP. Such altered versions are further
+ prohibited from misrepresentative use of the Zip-Bugs or Info-ZIP
+ e-mail addresses or the Info-ZIP URL(s), such as to imply Info-ZIP
+ will provide support for the altered versions.
+
+ 4. Info-ZIP retains the right to use the names "Info-ZIP," "Zip," "UnZip,"
+ "UnZipSFX," "WiZ," "Pocket UnZip," "Pocket Zip," and "MacZip" for its
+ own source and binary releases.
+---------------
+
+The container image inherits from the python:3.12-slim-bookworm
+base image a Debian userland containing components under reciprocal
+licenses, including GPL-2.0-or-later (libpam-modules,
+libpam-modules-bin, libpam-runtime, libpam0g). These components are
+supplied by the upstream base image and are not redistributed by the
+ASF in source form. Their license texts are distributed inside the
+container image at /usr/share/doc/<package>/copyright. See the WARN
+file beside this LICENSE.
+---------------
+
+The complete license text of every bundled Python component is
+distributed inside the container image, in the package metadata
+directory of each distribution:
+
+ <site-packages>/<distribution>-<version>.dist-info/
+
+as LICENSE, LICENSE.txt, COPYING or licenses/, together with METADATA.
+The license texts of Debian components are distributed at
+/usr/share/doc/<package>/copyright.
diff --git a/NOTICE b/NOTICE
index 13ed55a..9d75f1b 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,182 +1,151 @@
Apache OpenServerless (Incubating)
-Copyright 2024 The Apache Software Foundation
+Copyright 2024-2026 The Apache Software Foundation
This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).
+The Apache Software Foundation (https://www.apache.org/).
+The following notices apply to third-party software bundled in the
+container image built from the Dockerfile beside this file
+(docker.io/apache/openserverless-admin-api). They do not apply to the
+Apache source release, which contains only Apache-2.0 licensed files.
-==============================================================================
-BEGIN BUNDLED THIRD-PARTY SOFTWARE INVENTORY (container image)
-==============================================================================
+---------------
-------------------------------------------------------------------------------
-Container image: apache/openserverless-admin-api
-------------------------------------------------------------------------------
+The container image contains the CPython runtime and standard library,
+obtained from the python:3.12-slim-bookworm base image, which was released
+under the Python Software Foundation License Version 2.
-This image bundles third-party software. The components below are
-redistributed under the licenses recorded in the LICENSE file that
-accompanies this NOTICE. Components flagged '*** SEE WARN ***' are
-listed in the WARN file as incompatible with the Apache License 2.0.
+Copyright (c) 2001-2026 Python Software Foundation. All Rights Reserved.
+Copyright (c) 2000 BeOpen.com. All Rights Reserved.
+Copyright (c) 1995-2001 Corporation for National Research Initiatives.
+All Rights Reserved.
+Copyright (c) 1991-1995 Stichting Mathematisch Centrum, Amsterdam.
+All Rights Reserved.
-Python runtime dependencies (pyproject.toml / uv.lock)
-------------------------------------------------------
- * aiohappyeyeballs (2.6.1)
- License: PSF-2.0
- * aiohttp (3.14.3)
- License: Apache-2.0 AND MIT
- * aiosignal (1.4.0)
- License: Apache-2.0
- * asttokens (3.0.1)
- License: Apache-2.0
- * attrs (25.4.0)
- License: MIT
- * auth0-python (4.13.0)
- License: MIT
- * backoff (2.2.1)
- License: MIT
- * bcrypt (5.0.0)
- License: Apache-2.0
- * blinker (1.9.0)
- License: MIT
- * certifi (2025.11.12)
- License: MPL-2.0
- Category B: used unmodified, as a separate file.
- * cffi (2.0.0)
- License: MIT
- * charset-normalizer (3.4.4)
- License: MIT
- * click (8.3.1)
- License: BSD-3-Clause
- * colorama (0.4.6)
- License: BSD-3-Clause
- * cryptography (50.0.0)
- License: Apache-2.0 OR BSD-3-Clause
- * decorator (5.2.1)
- License: BSD-2-Clause
- * executing (2.2.1)
- License: MIT
- * flasgger (0.9.7.1)
- License: MIT
- * flask (3.1.2)
- License: BSD-3-Clause
- * flask-cors (6.0.1)
- License: MIT
- * flatdict (4.1.0)
- License: BSD-3-Clause
- * frozenlist (1.8.0)
- License: Apache-2.0
- * idna (3.15)
- License: BSD-3-Clause
- * ipython (9.8.0)
- License: BSD-3-Clause
- Dev-only dependency.
- * ipython-pygments-lexers (1.1.1)
- License: BSD-3-Clause
- Dev-only dependency.
- * itsdangerous (2.2.0)
- License: BSD-3-Clause
- * jedi (0.19.2)
- License: MIT
- * jinja2 (3.1.6)
- License: BSD-3-Clause
- * jsonschema (4.25.1)
- License: MIT
- * jsonschema-specifications (2025.9.1)
- License: MIT
- * markupsafe (3.0.3)
- License: BSD-3-Clause
- * matplotlib-inline (0.2.1)
- License: BSD-3-Clause
- * minio (7.1.13)
- License: Apache-2.0
- * mistune (3.3.0)
- License: BSD-3-Clause
- * multidict (6.7.0)
- License: Apache-2.0
- * packaging (25.0)
- License: Apache-2.0 OR BSD-2-Clause
- * parso (0.8.5)
- License: MIT
- * pexpect (4.9.0)
- License: ISC
- * prompt-toolkit (3.0.52)
- License: BSD-3-Clause
- * propcache (0.4.1)
- License: Apache-2.0
- * ptyprocess (0.7.0)
- License: ISC
- * pure-eval (0.2.3)
- License: MIT
- * pycparser (2.23)
- License: BSD-3-Clause
- * pygments (2.19.2)
- License: BSD-2-Clause
- * pyjwt (2.13.0)
- License: MIT
- * python-dotenv (1.2.2)
- License: BSD-3-Clause
- * pyyaml (6.0.3)
- License: MIT
- * redis (7.1.0)
- License: MIT
- * referencing (0.37.0)
- License: MIT
- * requests (2.32.5)
- License: Apache-2.0
- * rpds-py (0.30.0)
- License: MIT
- * six (1.17.0)
- License: MIT
- * stack-data (0.6.3)
- License: MIT
- * traitlets (5.14.3)
- License: BSD-3-Clause
- * typing-extensions (4.15.0)
- License: PSF-2.0
- * urllib3 (2.7.0)
- License: MIT
- * waitress (3.0.2)
- License: ZPL-2.1
- Category B: used unmodified, as a separate file.
- * wcwidth (0.2.14)
- License: MIT
- * werkzeug (3.1.4)
- License: BSD-3-Clause
- * yarl (1.22.0)
- License: Apache-2.0
+---------------
-Operating-system packages installed by the Dockerfile
------------------------------------------------------
- * uv (latest)
- License: Apache-2.0 OR MIT
- Python dependency manager, installed via pip.
- * curl ((Debian bookworm))
- License: curl (MIT-like)
- * zip, unzip ((Debian bookworm))
- License: Info-ZIP
+The container image contains uv, installed by the Dockerfile via pip,
+which was released under the Apache 2.0 license.
-Base operating system image
----------------------------
- * (see the FROM line of the Dockerfile) (-)
- License: mixed; see WARN
- Operating-system components are supplied by the upstream base image and are not
- redistributed by the ASF in source form.
- * libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g ((Debian bookworm))
- License: GPL-2.0-or-later AND BSD-3-Clause
- Shipped by the upstream base image; not installed by this Dockerfile.
- *** SEE WARN ***
+uv
+Copyright (c) Astral Software Inc.
-------------------------------------------------------------------------------
-Attribution required by bundled components
-------------------------------------------------------------------------------
+---------------
-This product includes software developed by the Apache Software
-Foundation (http://www.apache.org/), including Apache OpenWhisk
-components and Apache-2.0 licensed libraries listed above.
+The container image contains aiohttp, which was released under an
+Apache 2.0 license.
-This product includes software developed by third parties under the
-MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE.
+aiohttp
+Copyright aio-libs contributors
-==============================================================================
-END BUNDLED THIRD-PARTY SOFTWARE INVENTORY
-==============================================================================
+aiohttp bundles llhttp, which was released under an MIT license.
+
+Copyright (c) 2018 Fedor Indutny
+
+---------------
+
+The container image contains aiosignal and frozenlist, which were
+released under an Apache 2.0 license.
+
+Copyright 2013-2019 Nikolay Kim and Andrew Svetlov
+
+---------------
+
+The container image contains multidict, which was released under an
+Apache 2.0 license.
+
+Copyright 2016 Andrew Svetlov and aio-libs contributors
+
+---------------
+
+The container image contains propcache and yarl, which were released
+under an Apache 2.0 license.
+
+Copyright 2016-2021, Andrew Svetlov and aio-libs team
+
+---------------
+
+---------------
+
+The container image contains bcrypt, which was released under an
+Apache 2.0 license.
+
+Copyright (c) The Python Cryptographic Authority developers
+
+---------------
+
+The container image contains minio, which was released under an
+Apache 2.0 license.
+
+MinIO Python SDK for Amazon S3 Compatible Cloud Storage
+(C) 2015-2021 MinIO, Inc.
+
+---------------
+
+The container image contains requests, which was released under an
+Apache 2.0 license.
+
+Requests
+Copyright Kenneth Reitz
+
+---------------
+
+The container image contains cryptography, which was released under
+an Apache 2.0 license and a 3-clause BSD license, at the recipient's
+option.
+
+Copyright (c) Individual contributors.
+All rights reserved.
+
+---------------
+
+The container image contains packaging, which was released under an
+Apache 2.0 license and a 2-clause BSD license, at the recipient's
+option.
+
+Copyright (c) Donald Stufft and individual contributors.
+All rights reserved.
+
+---------------
+
+The container image contains curl, obtained from the Debian bookworm
+userland of the base image, which was released under an MIT-like
+license.
+
+Copyright (c) 1996 - 2026, Daniel Stenberg, <daniel@haxx.se>, and many
+contributors, see the THANKS file.
+
+---------------
+
+The container image contains zip and unzip, obtained from the Debian
+bookworm userland of the base image, which were released under the
+Info-ZIP license.
+
+Copyright (c) 1990-2009 Info-ZIP. All rights reserved.
+
+---------------
+
+The container image contains certifi, which distributes a modified
+version of the Mozilla CA root certificate bundle under the Mozilla
+Public License 2.0.
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+---------------
+
+The container image contains waitress, which was released under the
+Zope Public License 2.1.
+
+Copyright (c) Zope Foundation and Contributors.
+All Rights Reserved.
+
+---------------
+
+The container image inherits GPL-2.0-or-later and other reciprocally
+licensed operating-system components from the python:3.12-slim-bookworm
+base image, including libpam-modules, libpam-modules-bin,
+libpam-runtime and libpam0g. These components are supplied by the
+upstream base image and are not redistributed by the ASF in source
+form. See the WARN file beside this NOTICE.
diff --git a/WARN b/WARN
index 6f8ded2..c74031c 100644
--- a/WARN
+++ b/WARN
@@ -1,122 +1,271 @@
==============================================================================
-WARN -- Apache License 2.0 incompatibilities
-Container image: apache/openserverless-admin-api
+WARN -- warnings concerning LICENSE and NOTICE for the container image
+Container image: docker.io/apache/openserverless-admin-api
==============================================================================
-This file lists third-party components bundled by the Dockerfile beside
-it whose licenses are NOT compatible with the Apache License, Version 2.0,
-together with components that require special handling.
+This file records warnings raised while regenerating the LICENSE and NOTICE
+files beside it for the container image built from the Dockerfile. It is not
+itself a license document.
-Classification follows the ASF third-party licensing policy:
-
- https://www.apache.org/legal/resolved.html
+ASF third-party licensing policy: https://www.apache.org/legal/resolved.html
Category A Apache-2.0 compatible. May be included in a release.
Category B May be included in BINARY form only, unmodified and as a
separate file, with the reciprocal license disclosed.
Category X MUST NOT be included in an Apache release artifact.
-IMPORTANT SCOPE NOTE
-------------------------------------------------------------------------------
+
+==============================================================================
+SCOPE
+==============================================================================
+
The Apache release artifact for OpenServerless is the SOURCE distribution,
-which contains this Dockerfile and the files beside it -- all Apache-2.0
-licensed. The published container image is a CONVENIENCE BINARY assembled
-at build time from third-party base images and package repositories.
-Category X components inherited from a base operating system image are
-disclosed below but are not redistributed by the ASF in source form.
-Category X components that this Dockerfile ADDS on purpose must be removed.
+which contains the Dockerfile and the files beside it -- all Apache-2.0
+licensed. The published container image is a CONVENIENCE BINARY assembled at
+build time from a third-party base image and from package repositories.
+LICENSE and NOTICE now cover both: the license above the first separator
+applies to the source release, and each section below a separator applies to
+software bundled only in the image.
==============================================================================
-CATEGORY X
+WARN 1 -- LICENSE and NOTICE were regenerated, previous content replaced
==============================================================================
- None. This Dockerfile no longer adds any Category X component. The LGPL
- `psycopg` / `psycopg-binary` dependencies and the `telnet` / `inetutils-ping`
- packages that were previously listed here have been removed; see CATEGORY A
- below for the details of each resolution.
+ Severity : informational
+ Detail :
+ The previous LICENSE and NOTICE carried a summary-table inventory with
+ per-component license identifiers but NOT the license texts themselves;
+ they pointed at paths inside the image instead. They have been rewritten
+ in the style of the Apache Pekko LICENSE and NOTICE: Apache-2.0 text
+ first, then '---------------' separated sections, with the full text of
+ every non-Apache-2.0 license reproduced inline.
+ Action :
+ Review the diff before cutting the release.
==============================================================================
-CATEGORY X (as bundled)
+WARN 2 -- previous inventory listed packages that are NOT in the image
==============================================================================
- Component : libpam-modules-bin
- License : GPL-2.0-or-later AND BSD-3-Clause
- Category : X (as bundled)
- Action :
- GPL-2.0 components arrive from the base operating system. This Dockerfile no
- longer installs `libpam-modules-bin` explicitly -- it has been REMOVED from the
- apt install list, since nothing in this service uses PAM authentication. The
- package is nevertheless still present in the image because the upstream
- python:3.12-slim-bookworm base image ships libpam-modules, libpam-modules-bin,
- libpam-runtime and libpam0g as part of the Debian userland. It is therefore
- inherited, not added, and is disclosed here on that basis. No further action
- required.
+ Severity : correctness (resolved in the regenerated files)
+ Detail :
+ The previous LICENSE/NOTICE listed 59 Python packages. The Dockerfile
+ runs `uv pip install --requirement pyproject.toml`, which installs the
+ default dependency group only -- the `dev` extra is never installed.
+ Resolving pyproject.toml against uv.lock yields 43 packages.
- Component : Debian/Ubuntu/Alpine base image userland
- License : mixed, incl. GPL-2.0/GPL-3.0
- Category : X (as bundled)
- Action :
- The base image contains GPL-licensed operating-system components. The Apache release
- artifact is the SOURCE (this Dockerfile and the files beside it); the published
- container image is a convenience binary assembled from third-party base images.
- No action required beyond this disclosure.
+ The following were listed but are NOT present in the runtime image and
+ have been REMOVED from LICENSE and NOTICE:
+
+ asttokens, colorama, decorator, executing, ipython,
+ ipython-pygments-lexers, jedi, matplotlib-inline, parso, pexpect,
+ prompt-toolkit, ptyprocess, pure-eval, pygments, stack-data,
+ traitlets, wcwidth
+
+ Over-disclosure is not a license violation, but it misstates the
+ contents of the artifact and drags in licenses (ISC, BSD-2-Clause)
+ that nothing in the image actually uses.
+ Action :
+ None required. Note that if the Dockerfile is ever changed to install
+ the dev extra, these packages must be restored.
==============================================================================
-CATEGORY B
+WARN 3 -- cffi is MIT No Attribution, not MIT
==============================================================================
- Component : certifi / ca-certificates
- License : MPL-2.0
- Category : B
- Action :
- Category B: MPL-2.0 may be included in binary form only, unmodified and as a
- separate file. That is satisfied here. No action required.
-
- Component : waitress
- License : ZPL-2.1
- Category : B
- Action :
- Category B: the Zope Public License 2.1 may be included in binary form only,
- unmodified and as a separate file. That is satisfied here. No action required.
+ Severity : correctness (resolved in the regenerated files)
+ Category : A
+ Detail :
+ The previous inventory recorded cffi (2.0.0) as plain MIT. The license
+ file shipped in cffi-2.0.0.dist-info/licenses/LICENSE is "MIT No
+ Attribution" (MIT-0), a distinct, more permissive license. It is now
+ reproduced in its own LICENSE section.
+ Action :
+ None required. Both are Category A.
==============================================================================
-CATEGORY A
+WARN 4 -- CPython itself was never disclosed
==============================================================================
- Component : zip / unzip (Info-ZIP)
- License : Info-ZIP License
- Category : A
- Action :
- BSD-like and Apache-compatible. No action required.
-
- Component : curl
- License : curl (MIT-like)
- Category : A
- Action :
- Apache-compatible. The `telnet` and `inetutils-ping` packages previously
- installed beside it have been REMOVED from the Dockerfile: they were
- debugging conveniences and nothing in the service invokes them.
- No action required.
-
- Component : PostgreSQL client (formerly psycopg / psycopg-binary)
- License : n/a -- dependency removed
- Category : A
- Action :
- The LGPL `psycopg` and `psycopg-binary` dependencies have been REMOVED from
- pyproject.toml and uv.lock. No module in this service imported them: the
- admin API persists its data in CouchDB, and the `postgres_*` fields it
- handles are configuration values written into WhiskUser custom resources,
- which the operator acts on. No PostgreSQL driver is required here.
- No action required.
+ Severity : omission (resolved in the regenerated files)
+ Category : A
+ Detail :
+ The image is built `FROM python:3.12-slim-bookworm` and ships the CPython
+ runtime and standard library, which are the single largest bundled
+ third-party component. Neither the previous LICENSE nor the previous
+ NOTICE mentioned CPython or the Python Software Foundation License.
+ The PSF License Version 2 text is now reproduced in LICENSE and the PSF
+ copyright chain is recorded in NOTICE.
+ Action :
+ None required.
==============================================================================
-SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile)
+WARN 5 -- Category X inherited from the base image (GPL-2.0-or-later)
==============================================================================
- (none -- all Category X components added by this Dockerfile have been removed)
+ Severity : disclosure required
+ Category : X (as bundled)
+ Components:
+ libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g
+ License: GPL-2.0-or-later AND BSD-3-Clause
+ plus further reciprocally licensed Debian userland components.
+ Detail :
+ These arrive from the python:3.12-slim-bookworm base image. The
+ Dockerfile does not install them: its only `apt-get install` line adds
+ curl, zip and unzip. They are therefore INHERITED, not added, and
+ nothing in this service uses PAM authentication.
+ The ASF does not redistribute these in source form; they are present
+ only in the convenience binary. This is disclosed in both LICENSE and
+ NOTICE.
+ Action :
+ No removal possible without changing base image. Disclosure is the
+ required and sufficient remedy. Do NOT add any further GPL component
+ deliberately.
+
+
+==============================================================================
+WARN 6 -- Category B components (reciprocal, binary-only)
+==============================================================================
+
+ Severity : conditions must hold
+ Components:
+ certifi (2025.11.12) -- MPL-2.0
+ waitress (3.0.2) -- ZPL-2.1
+ Detail :
+ Category B permits inclusion in BINARY form only, unmodified and as a
+ separate file, with the reciprocal license disclosed. Both are installed
+ unmodified as separate wheels by uv and are not statically combined with
+ or patched by OpenServerless code. Full MPL-2.0 reference and ZPL-2.1
+ text are reproduced in LICENSE.
+
+ Note: certifi's own license file states it contains a MODIFIED version
+ of Mozilla's ca-bundle.crt. The modification is made by the certifi
+ project upstream, not by OpenServerless; OpenServerless ships certifi
+ unmodified. This satisfies Category B.
+ Action :
+ None required. Do not patch either package in the image.
+
+
+==============================================================================
+WARN 7 -- copyright holders that could not be verified from the artifact
+==============================================================================
+
+ Severity : verify before release
+ Detail :
+ Copyright lines in LICENSE and NOTICE were extracted from the license
+ files actually shipped in each installed distribution. For a few
+ components the shipped license file is the bare Apache-2.0 text with no
+ copyright line, so the attribution was taken from package metadata or
+ source headers instead:
+
+ bcrypt -- taken from METADATA Author-email
+ (The Python Cryptographic Authority developers)
+ minio -- taken from "(C) 2015-2021 MinIO, Inc." in source headers
+ requests -- taken from __version__.py (__copyright__)
+ uv -- NOT installed locally; uv is installed by pip at image
+ build time. Its attribution (Astral Software Inc.,
+ Apache-2.0 OR MIT) was not verified against a built
+ image.
+ curl -- Debian package; its copyright range and license text
+ were not read from the image.
+ zip/unzip -- Debian packages; Info-ZIP license text was not read
+ from the image.
+ CPython -- PSF copyright chain not read from the base image.
+
+ Docker was unavailable in the environment where these files were
+ regenerated, so no component was verified against an actually built
+ image. The 43 Python packages WERE verified by resolving pyproject.toml
+ against uv.lock and reading each installed dist-info.
+ Action :
+ Before the release vote, build the image and confirm the Debian, uv and
+ CPython attributions against /usr/share/doc/<pkg>/copyright and the
+ base image, and adjust the corresponding LICENSE/NOTICE sections.
+
+
+==============================================================================
+WARN 8 -- LICENSE/NOTICE are copied to / in the image, not to a doc path
+==============================================================================
+
+ Severity : minor
+ Detail :
+ The Dockerfile has:
+
+ COPY DISCLAIMER LICENSE NOTICE /
+
+ WARN is NOT copied into the image, although both LICENSE and NOTICE
+ refer the reader to "the WARN file beside this file". Inside the image
+ that reference cannot be followed.
+ Action :
+ Either add WARN to that COPY line, or drop the in-image cross-reference.
+ Consider also placing the files under a conventional path such as
+ /usr/share/doc/openserverless-admin-api/ in addition to /.
+
+
+==============================================================================
+WARN 9 -- dual-licensed components: no election recorded
+==============================================================================
+
+ Severity : informational
+ Components:
+ cryptography (50.0.0) -- Apache-2.0 OR BSD-3-Clause
+ packaging (25.0) -- Apache-2.0 OR BSD-2-Clause
+ uv -- Apache-2.0 OR MIT
+ Detail :
+ These are offered under a choice of licenses. LICENSE reproduces both
+ options for each rather than electing one, which is permissible but
+ leaves the election implicit.
+ Action :
+ Optional: state that the ASF elects Apache-2.0 for each, which
+ simplifies the inventory.
+
+
+==============================================================================
+WARN 10 -- aiohttp is Apache-2.0 AND MIT
+==============================================================================
+
+ Severity : informational
+ Category : A
+ Detail :
+ aiohttp (3.14.3) declares "Apache-2.0 AND MIT" -- a conjunction, not a
+ choice: it is Apache-2.0 licensed and vendors llhttp under MIT
+ (Copyright (c) 2018 Fedor Indutny). Both are disclosed.
+ Action :
+ None required.
+
+
+==============================================================================
+WARN 11 -- previously recorded removals are confirmed still absent
+==============================================================================
+
+ Severity : informational
+ Detail :
+ The previous WARN recorded that the LGPL `psycopg`/`psycopg-binary`
+ dependencies and the `telnet`/`inetutils-ping` packages had been
+ removed. Both removals are confirmed against the current tree:
+ pyproject.toml and uv.lock contain no psycopg, and the Dockerfile's
+ apt install list is curl, zip, unzip only.
+ Action :
+ None required. Do not reintroduce them.
+
+
+==============================================================================
+SUMMARY
+==============================================================================
+
+ Category X added deliberately by this Dockerfile : none
+ Category X inherited from the base image : GPL-2.0-or-later Debian
+ userland (disclosed,
+ WARN 5)
+ Category B components : certifi, waitress
+ (conditions hold, WARN 6)
+ Blocking issues : none
+ Open before release vote : WARN 7 (verify Debian /
+ uv / CPython attributions
+ against a built image)
+ WARN 8 (WARN not shipped
+ in image)
diff --git a/deploy/samples/requirements.txt b/deploy/samples/requirements.txt
index 349475f..d66830f 100644
--- a/deploy/samples/requirements.txt
+++ b/deploy/samples/requirements.txt
@@ -1,2 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
beautifulsoup4
setuptools
diff --git a/uv.lock b/uv.lock
index 2f02511..6f4d79a 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,3 +1,21 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
version = 1
revision = 3
requires-python = ">=3.12"
