Skip to content

THIRD_PARTY_NOTICES.md

Latest commit

 

History

History
17 lines (12 loc) · 803 Bytes

THIRD_PARTY_NOTICES.md

File metadata and controls

17 lines (12 loc) · 803 Bytes
Raw

Third-party notices

Merchval Kernel depends on third-party software. The generated authoritative Python inventory and CycloneDX SBOM are:

  • docs/release/dependency-inventory.md
  • docs/release/sbom.cdx.json

Notable runtime obligations include:

  • psycopg, psycopg-binary, and psycopg-pool: LGPL-3.0-only;
  • certifi: MPL-2.0;
  • Open Policy Agent: Apache-2.0;
  • PostgreSQL 16: PostgreSQL License;
  • Redis 7.2: BSD-3-Clause;
  • CPython and the Debian base: their respective upstream licenses.

The project license does not replace or weaken third-party licenses. A distributor of the container image must preserve notices and satisfy the corresponding source, replacement, and redistribution obligations of the components it conveys. This file is an engineering inventory, not legal advice.