This is an automated email from the ASF dual-hosted git repository. sciabarracom pushed a commit to branch 0.9.0 in repository https://gitbox.apache.org/repos/asf/openserverless-runtimes.git
commit 271c568bc1eed66b013cd0f74129fa84c6f6e697 Author: Michele Sciabarra <[email protected]> AuthorDate: Sun Sep 6 17:18:52 2026 +0200 updated deps --- runtime/common/common1.17.1/Dockerfile | 2 +- runtime/common/common1.18.4/Dockerfile | 2 +- runtime/go/v1.25/Dockerfile | 2 +- runtime/go/v1.25/LICENSE | 18 +--- runtime/go/v1.25/NOTICE | 12 +-- runtime/go/v1.25/WARN | 40 ++------- runtime/go/v1.26/Dockerfile | 2 +- runtime/go/v1.26/LICENSE | 18 +--- runtime/go/v1.26/NOTICE | 12 +-- runtime/go/v1.26/WARN | 40 ++------- runtime/go/v1.27/Dockerfile | 2 +- runtime/go/v1.27/LICENSE | 18 +--- runtime/go/v1.27/NOTICE | 12 +-- runtime/go/v1.27/WARN | 40 ++------- runtime/java/v11/Dockerfile | 2 +- runtime/java/v11/LICENSE | 5 -- runtime/java/v11/NOTICE | 3 - runtime/java/v11/WARN | 15 +--- runtime/java/v17/Dockerfile | 2 +- runtime/java/v17/LICENSE | 5 -- runtime/java/v17/NOTICE | 3 - runtime/java/v17/WARN | 15 +--- runtime/java/v21/Dockerfile | 2 +- runtime/java/v21/LICENSE | 5 -- runtime/java/v21/NOTICE | 3 - runtime/java/v21/WARN | 15 +--- runtime/java/v8/Dockerfile | 2 +- runtime/java/v8/LICENSE | 5 -- runtime/java/v8/NOTICE | 3 - runtime/java/v8/WARN | 15 +--- runtime/nodejs/v20/Dockerfile | 2 +- runtime/nodejs/v20/LICENSE | 46 ++++------ runtime/nodejs/v20/NOTICE | 26 ++---- runtime/nodejs/v20/WARN | 32 +++---- runtime/nodejs/v22/Dockerfile | 2 +- runtime/nodejs/v22/LICENSE | 48 ++++------- runtime/nodejs/v22/NOTICE | 28 +++--- runtime/nodejs/v22/WARN | 36 +++----- runtime/nodejs/v24/Dockerfile | 2 +- runtime/nodejs/v24/LICENSE | 48 ++++------- runtime/nodejs/v24/NOTICE | 28 +++--- runtime/nodejs/v24/WARN | 36 +++----- runtime/php/v8.2/Dockerfile | 2 +- runtime/php/v8.3/Dockerfile | 2 +- runtime/python/v3.11/Dockerfile | 2 +- runtime/python/v3.11/LICENSE | 122 ++++++++++++-------------- runtime/python/v3.11/NOTICE | 66 +++++++------- runtime/python/v3.11/WARN | 37 ++------ runtime/python/v3.12/Dockerfile | 2 +- runtime/python/v3.12/LICENSE | 153 ++++++++++++++------------------- runtime/python/v3.12/NOTICE | 83 ++++++++---------- runtime/python/v3.12/WARN | 45 ++-------- runtime/python/v3.13/Dockerfile | 2 +- runtime/python/v3.13/LICENSE | 29 ++----- runtime/python/v3.13/NOTICE | 21 +---- runtime/python/v3.13/WARN | 69 +++++---------- 56 files changed, 396 insertions(+), 893 deletions(-) diff --git a/runtime/common/common1.17.1/Dockerfile b/runtime/common/common1.17.1/Dockerfile index 72033a9..0a219ab 100644 --- a/runtime/common/common1.17.1/Dockerfile +++ b/runtime/common/common1.17.1/Dockerfile @@ -22,6 +22,6 @@ USER nobody RUN CGO_ENABLED=0 go install github.com/apache/[email protected] RUN mv /go/bin/openserverless-runtimes /go/bin/proxy # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT [ "/go/bin/proxy" ] diff --git a/runtime/common/common1.18.4/Dockerfile b/runtime/common/common1.18.4/Dockerfile index 931f70d..f58cd48 100644 --- a/runtime/common/common1.18.4/Dockerfile +++ b/runtime/common/common1.18.4/Dockerfile @@ -21,6 +21,6 @@ USER nobody RUN CGO_ENABLED=0 go build RUN mv openserverless-runtimes /go/bin/proxy # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT [ "/go/bin/proxy" ] diff --git a/runtime/go/v1.25/Dockerfile b/runtime/go/v1.25/Dockerfile index 4435687..f3dd8bc 100644 --- a/runtime/go/v1.25/Dockerfile +++ b/runtime/go/v1.25/Dockerfile @@ -46,6 +46,6 @@ WORKDIR /action RUN chown nobody:root /action ; chmod 0775 /action USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT [ "/bin/proxy" ] diff --git a/runtime/go/v1.25/LICENSE b/runtime/go/v1.25/LICENSE index caf0f8f..515f5a2 100644 --- a/runtime/go/v1.25/LICENSE +++ b/runtime/go/v1.25/LICENSE @@ -204,7 +204,7 @@ ============================================================================== LICENSES OF BUNDLED THIRD-PARTY SOFTWARE -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.25 ============================================================================== Apache OpenServerless itself is licensed under the Apache License, @@ -231,12 +231,6 @@ BSD-3-Clause github.com/pmezard/go-difflib (v1.0.0) golang.org/x/sys (v0.26.0) -GPL-2.0 - git ((Debian bookworm)) - -GPL-2.0-or-later - apt-utils ((Debian bookworm)) - ISC github.com/davecgh/go-spew (v1.1.1) @@ -250,9 +244,6 @@ MIT github.com/stretchr/testify (v1.9.0) jq ((Debian bookworm)) -Vim License (charityware) - vim ((Debian bookworm)) - curl (MIT-like) curl ((Debian bookworm)) @@ -267,14 +258,8 @@ Operating-system packages installed by the Dockerfile ----------------------------------------------------- curl ((Debian bookworm)) -- curl (MIT-like) jq ((Debian bookworm)) -- MIT - git ((Debian bookworm)) -- GPL-2.0 - *** SEE WARN *** zip ((Debian bookworm)) -- Info-ZIP - vim ((Debian bookworm)) -- Vim License (charityware) - *** SEE WARN *** librdkafka1 / librdkafka++1 / librdkafka-dev ((Debian bookworm)) -- BSD-2-Clause - apt-utils ((Debian bookworm)) -- GPL-2.0-or-later - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -315,4 +300,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/go/v1.25/NOTICE b/runtime/go/v1.25/NOTICE index 42f5ea8..9636d20 100644 --- a/runtime/go/v1.25/NOTICE +++ b/runtime/go/v1.25/NOTICE @@ -5,7 +5,7 @@ This product includes software developed at The Apache Software Foundation (http://www.apache.org/). ------------------------------------------------------------------------------ -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.25 ------------------------------------------------------------------------------ This image bundles third-party software. The components below are @@ -19,19 +19,10 @@ Operating-system packages installed by the Dockerfile License: curl (MIT-like) * jq ((Debian bookworm)) License: MIT - * git ((Debian bookworm)) - License: GPL-2.0 - *** SEE WARN *** * zip ((Debian bookworm)) License: Info-ZIP - * vim ((Debian bookworm)) - License: Vim License (charityware) - *** SEE WARN *** * librdkafka1 / librdkafka++1 / librdkafka-dev ((Debian bookworm)) License: BSD-2-Clause - * apt-utils ((Debian bookworm)) - License: GPL-2.0-or-later - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -78,4 +69,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/go/v1.25/WARN b/runtime/go/v1.25/WARN index f268881..c3c5123 100644 --- a/runtime/go/v1.25/WARN +++ b/runtime/go/v1.25/WARN @@ -1,6 +1,6 @@ ============================================================================== WARN -- Apache License 2.0 incompatibilities -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.25 ============================================================================== This file lists third-party components bundled by the Dockerfile beside @@ -28,34 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : git - License : GPL-2.0 - Category : X - Action : - GPL-2.0 is Category X. Shipped in the final image so that user actions can fetch - sources. REMOVE it, or document it as an operating-system component supplied by - the base image rather than by the ASF release. - - Component : vim - License : Vim License (charityware) - Category : X - Action : - The Vim licence is GPL-compatible but is not on the ASF Category A list and - contains a charityware clause. It is a developer convenience only. - REMOVE `vim` from the apt install list. - - Component : apt-utils - License : GPL-2.0-or-later - Category : X - Action : - GPL-2.0, and only needed during the build. REMOVE from the final image layer. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -83,16 +56,15 @@ CATEGORY A SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] git -- GPL-2.0 - [x] vim -- Vim License (charityware) - [x] apt-utils -- GPL-2.0-or-later + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: golang:1.20-bookworm. The Go toolchain is BSD-3-Clause licensed. +Base image: golang:1.26-bookworm. The Go toolchain is BSD-3-Clause licensed. This image ships no preinstalled Go libraries: user actions declare their own dependencies, which are fetched at action-compile time and are NOT part of this image or of any Apache release artifact. - +The `git`, `vim` and `apt-utils` packages flagged in earlier revisions of +this file are no longer installed by the Dockerfile. diff --git a/runtime/go/v1.26/Dockerfile b/runtime/go/v1.26/Dockerfile index 4435687..f3dd8bc 100644 --- a/runtime/go/v1.26/Dockerfile +++ b/runtime/go/v1.26/Dockerfile @@ -46,6 +46,6 @@ WORKDIR /action RUN chown nobody:root /action ; chmod 0775 /action USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT [ "/bin/proxy" ] diff --git a/runtime/go/v1.26/LICENSE b/runtime/go/v1.26/LICENSE index caf0f8f..2ebfa3c 100644 --- a/runtime/go/v1.26/LICENSE +++ b/runtime/go/v1.26/LICENSE @@ -204,7 +204,7 @@ ============================================================================== LICENSES OF BUNDLED THIRD-PARTY SOFTWARE -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.26 ============================================================================== Apache OpenServerless itself is licensed under the Apache License, @@ -231,12 +231,6 @@ BSD-3-Clause github.com/pmezard/go-difflib (v1.0.0) golang.org/x/sys (v0.26.0) -GPL-2.0 - git ((Debian bookworm)) - -GPL-2.0-or-later - apt-utils ((Debian bookworm)) - ISC github.com/davecgh/go-spew (v1.1.1) @@ -250,9 +244,6 @@ MIT github.com/stretchr/testify (v1.9.0) jq ((Debian bookworm)) -Vim License (charityware) - vim ((Debian bookworm)) - curl (MIT-like) curl ((Debian bookworm)) @@ -267,14 +258,8 @@ Operating-system packages installed by the Dockerfile ----------------------------------------------------- curl ((Debian bookworm)) -- curl (MIT-like) jq ((Debian bookworm)) -- MIT - git ((Debian bookworm)) -- GPL-2.0 - *** SEE WARN *** zip ((Debian bookworm)) -- Info-ZIP - vim ((Debian bookworm)) -- Vim License (charityware) - *** SEE WARN *** librdkafka1 / librdkafka++1 / librdkafka-dev ((Debian bookworm)) -- BSD-2-Clause - apt-utils ((Debian bookworm)) -- GPL-2.0-or-later - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -315,4 +300,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/go/v1.26/NOTICE b/runtime/go/v1.26/NOTICE index 42f5ea8..c2ee1e4 100644 --- a/runtime/go/v1.26/NOTICE +++ b/runtime/go/v1.26/NOTICE @@ -5,7 +5,7 @@ This product includes software developed at The Apache Software Foundation (http://www.apache.org/). ------------------------------------------------------------------------------ -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.26 ------------------------------------------------------------------------------ This image bundles third-party software. The components below are @@ -19,19 +19,10 @@ Operating-system packages installed by the Dockerfile License: curl (MIT-like) * jq ((Debian bookworm)) License: MIT - * git ((Debian bookworm)) - License: GPL-2.0 - *** SEE WARN *** * zip ((Debian bookworm)) License: Info-ZIP - * vim ((Debian bookworm)) - License: Vim License (charityware) - *** SEE WARN *** * librdkafka1 / librdkafka++1 / librdkafka-dev ((Debian bookworm)) License: BSD-2-Clause - * apt-utils ((Debian bookworm)) - License: GPL-2.0-or-later - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -78,4 +69,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/go/v1.26/WARN b/runtime/go/v1.26/WARN index f268881..f931153 100644 --- a/runtime/go/v1.26/WARN +++ b/runtime/go/v1.26/WARN @@ -1,6 +1,6 @@ ============================================================================== WARN -- Apache License 2.0 incompatibilities -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.26 ============================================================================== This file lists third-party components bundled by the Dockerfile beside @@ -28,34 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : git - License : GPL-2.0 - Category : X - Action : - GPL-2.0 is Category X. Shipped in the final image so that user actions can fetch - sources. REMOVE it, or document it as an operating-system component supplied by - the base image rather than by the ASF release. - - Component : vim - License : Vim License (charityware) - Category : X - Action : - The Vim licence is GPL-compatible but is not on the ASF Category A list and - contains a charityware clause. It is a developer convenience only. - REMOVE `vim` from the apt install list. - - Component : apt-utils - License : GPL-2.0-or-later - Category : X - Action : - GPL-2.0, and only needed during the build. REMOVE from the final image layer. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -83,16 +56,15 @@ CATEGORY A SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] git -- GPL-2.0 - [x] vim -- Vim License (charityware) - [x] apt-utils -- GPL-2.0-or-later + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: golang:1.20-bookworm. The Go toolchain is BSD-3-Clause licensed. +Base image: golang:1.26-bookworm. The Go toolchain is BSD-3-Clause licensed. This image ships no preinstalled Go libraries: user actions declare their own dependencies, which are fetched at action-compile time and are NOT part of this image or of any Apache release artifact. - +The `git`, `vim` and `apt-utils` packages flagged in earlier revisions of +this file are no longer installed by the Dockerfile. diff --git a/runtime/go/v1.27/Dockerfile b/runtime/go/v1.27/Dockerfile index 582a4f7..cf32022 100644 --- a/runtime/go/v1.27/Dockerfile +++ b/runtime/go/v1.27/Dockerfile @@ -46,6 +46,6 @@ WORKDIR /action RUN chown nobody:root /action ; chmod 0775 /action USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT [ "/bin/proxy" ] diff --git a/runtime/go/v1.27/LICENSE b/runtime/go/v1.27/LICENSE index caf0f8f..a2eb0e9 100644 --- a/runtime/go/v1.27/LICENSE +++ b/runtime/go/v1.27/LICENSE @@ -204,7 +204,7 @@ ============================================================================== LICENSES OF BUNDLED THIRD-PARTY SOFTWARE -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.27 ============================================================================== Apache OpenServerless itself is licensed under the Apache License, @@ -231,12 +231,6 @@ BSD-3-Clause github.com/pmezard/go-difflib (v1.0.0) golang.org/x/sys (v0.26.0) -GPL-2.0 - git ((Debian bookworm)) - -GPL-2.0-or-later - apt-utils ((Debian bookworm)) - ISC github.com/davecgh/go-spew (v1.1.1) @@ -250,9 +244,6 @@ MIT github.com/stretchr/testify (v1.9.0) jq ((Debian bookworm)) -Vim License (charityware) - vim ((Debian bookworm)) - curl (MIT-like) curl ((Debian bookworm)) @@ -267,14 +258,8 @@ Operating-system packages installed by the Dockerfile ----------------------------------------------------- curl ((Debian bookworm)) -- curl (MIT-like) jq ((Debian bookworm)) -- MIT - git ((Debian bookworm)) -- GPL-2.0 - *** SEE WARN *** zip ((Debian bookworm)) -- Info-ZIP - vim ((Debian bookworm)) -- Vim License (charityware) - *** SEE WARN *** librdkafka1 / librdkafka++1 / librdkafka-dev ((Debian bookworm)) -- BSD-2-Clause - apt-utils ((Debian bookworm)) -- GPL-2.0-or-later - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -315,4 +300,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/go/v1.27/NOTICE b/runtime/go/v1.27/NOTICE index 42f5ea8..42e184b 100644 --- a/runtime/go/v1.27/NOTICE +++ b/runtime/go/v1.27/NOTICE @@ -5,7 +5,7 @@ This product includes software developed at The Apache Software Foundation (http://www.apache.org/). ------------------------------------------------------------------------------ -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.27 ------------------------------------------------------------------------------ This image bundles third-party software. The components below are @@ -19,19 +19,10 @@ Operating-system packages installed by the Dockerfile License: curl (MIT-like) * jq ((Debian bookworm)) License: MIT - * git ((Debian bookworm)) - License: GPL-2.0 - *** SEE WARN *** * zip ((Debian bookworm)) License: Info-ZIP - * vim ((Debian bookworm)) - License: Vim License (charityware) - *** SEE WARN *** * librdkafka1 / librdkafka++1 / librdkafka-dev ((Debian bookworm)) License: BSD-2-Clause - * apt-utils ((Debian bookworm)) - License: GPL-2.0-or-later - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -78,4 +69,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/go/v1.27/WARN b/runtime/go/v1.27/WARN index f268881..01504a9 100644 --- a/runtime/go/v1.27/WARN +++ b/runtime/go/v1.27/WARN @@ -1,6 +1,6 @@ ============================================================================== WARN -- Apache License 2.0 incompatibilities -Container image: apache/openserverless-runtime-golang:v1.20 +Container image: apache/openserverless-runtime-golang:v1.27 ============================================================================== This file lists third-party components bundled by the Dockerfile beside @@ -28,34 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : git - License : GPL-2.0 - Category : X - Action : - GPL-2.0 is Category X. Shipped in the final image so that user actions can fetch - sources. REMOVE it, or document it as an operating-system component supplied by - the base image rather than by the ASF release. - - Component : vim - License : Vim License (charityware) - Category : X - Action : - The Vim licence is GPL-compatible but is not on the ASF Category A list and - contains a charityware clause. It is a developer convenience only. - REMOVE `vim` from the apt install list. - - Component : apt-utils - License : GPL-2.0-or-later - Category : X - Action : - GPL-2.0, and only needed during the build. REMOVE from the final image layer. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -83,16 +56,15 @@ CATEGORY A SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] git -- GPL-2.0 - [x] vim -- Vim License (charityware) - [x] apt-utils -- GPL-2.0-or-later + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: golang:1.20-bookworm. The Go toolchain is BSD-3-Clause licensed. +Base image: golang:1.27-bookworm. The Go toolchain is BSD-3-Clause licensed. This image ships no preinstalled Go libraries: user actions declare their own dependencies, which are fetched at action-compile time and are NOT part of this image or of any Apache release artifact. - +The `git`, `vim` and `apt-utils` packages flagged in earlier revisions of +this file are no longer installed by the Dockerfile. diff --git a/runtime/java/v11/Dockerfile b/runtime/java/v11/Dockerfile index ae6cdb4..18f2ad5 100644 --- a/runtime/java/v11/Dockerfile +++ b/runtime/java/v11/Dockerfile @@ -62,6 +62,6 @@ ENV OW_COMPILER=/bin/compile ENV OW_SAVE_JAR=exec.jar # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/java/v11/LICENSE b/runtime/java/v11/LICENSE index 2872a37..c4891c5 100644 --- a/runtime/java/v11/LICENSE +++ b/runtime/java/v11/LICENSE @@ -249,9 +249,6 @@ MIT PSF-2.0 python ((Ubuntu focal)) -Vim License (charityware) - vim ((Ubuntu focal)) - mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -271,8 +268,6 @@ Operating-system packages and base runtime locales (glibc) ((Ubuntu focal)) -- GPL-2.0-or-later AND LGPL-2.1-or-later *** SEE WARN *** python ((Ubuntu focal)) -- PSF-2.0 - vim ((Ubuntu focal)) -- Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v11/NOTICE b/runtime/java/v11/NOTICE index d739842..3f5454a 100644 --- a/runtime/java/v11/NOTICE +++ b/runtime/java/v11/NOTICE @@ -29,9 +29,6 @@ Operating-system packages and base runtime *** SEE WARN *** * python ((Ubuntu focal)) License: PSF-2.0 - * vim ((Ubuntu focal)) - License: Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v11/WARN b/runtime/java/v11/WARN index 15f86af..9ff8368 100644 --- a/runtime/java/v11/WARN +++ b/runtime/java/v11/WARN @@ -27,19 +27,6 @@ disclosed below but are not redistributed by the ASF in source form. Category X components that this Dockerfile ADDS on purpose must be removed. -============================================================================== -CATEGORY X -============================================================================== - - Component : vim - License : Vim License (charityware) - Category : X - Action : - The Vim licence is GPL-compatible but is not on the ASF Category A list and - contains a charityware clause. It is a developer convenience only. - REMOVE `vim` from the apt install list. - - ============================================================================== CATEGORY X (as bundled) ============================================================================== @@ -75,7 +62,7 @@ CATEGORY X (as bundled) SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] vim -- Vim License (charityware) + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES diff --git a/runtime/java/v17/Dockerfile b/runtime/java/v17/Dockerfile index 26fadff..758649b 100644 --- a/runtime/java/v17/Dockerfile +++ b/runtime/java/v17/Dockerfile @@ -62,6 +62,6 @@ ENV OW_COMPILER=/bin/compile ENV OW_SAVE_JAR=exec.jar # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/java/v17/LICENSE b/runtime/java/v17/LICENSE index bd344b8..8f4a253 100644 --- a/runtime/java/v17/LICENSE +++ b/runtime/java/v17/LICENSE @@ -249,9 +249,6 @@ MIT PSF-2.0 python ((Ubuntu focal)) -Vim License (charityware) - vim ((Ubuntu focal)) - mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -271,8 +268,6 @@ Operating-system packages and base runtime locales (glibc) ((Ubuntu focal)) -- GPL-2.0-or-later AND LGPL-2.1-or-later *** SEE WARN *** python ((Ubuntu focal)) -- PSF-2.0 - vim ((Ubuntu focal)) -- Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v17/NOTICE b/runtime/java/v17/NOTICE index e0d0191..dceee04 100644 --- a/runtime/java/v17/NOTICE +++ b/runtime/java/v17/NOTICE @@ -29,9 +29,6 @@ Operating-system packages and base runtime *** SEE WARN *** * python ((Ubuntu focal)) License: PSF-2.0 - * vim ((Ubuntu focal)) - License: Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v17/WARN b/runtime/java/v17/WARN index 117617e..1de0bef 100644 --- a/runtime/java/v17/WARN +++ b/runtime/java/v17/WARN @@ -27,19 +27,6 @@ disclosed below but are not redistributed by the ASF in source form. Category X components that this Dockerfile ADDS on purpose must be removed. -============================================================================== -CATEGORY X -============================================================================== - - Component : vim - License : Vim License (charityware) - Category : X - Action : - The Vim licence is GPL-compatible but is not on the ASF Category A list and - contains a charityware clause. It is a developer convenience only. - REMOVE `vim` from the apt install list. - - ============================================================================== CATEGORY X (as bundled) ============================================================================== @@ -75,7 +62,7 @@ CATEGORY X (as bundled) SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] vim -- Vim License (charityware) + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES diff --git a/runtime/java/v21/Dockerfile b/runtime/java/v21/Dockerfile index 19de50c..e940e81 100644 --- a/runtime/java/v21/Dockerfile +++ b/runtime/java/v21/Dockerfile @@ -62,6 +62,6 @@ ENV OW_COMPILER=/bin/compile ENV OW_SAVE_JAR=exec.jar # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/java/v21/LICENSE b/runtime/java/v21/LICENSE index ceee974..ae8a0e9 100644 --- a/runtime/java/v21/LICENSE +++ b/runtime/java/v21/LICENSE @@ -249,9 +249,6 @@ MIT PSF-2.0 python ((Ubuntu focal)) -Vim License (charityware) - vim ((Ubuntu focal)) - mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -271,8 +268,6 @@ Operating-system packages and base runtime locales (glibc) ((Ubuntu focal)) -- GPL-2.0-or-later AND LGPL-2.1-or-later *** SEE WARN *** python ((Ubuntu focal)) -- PSF-2.0 - vim ((Ubuntu focal)) -- Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v21/NOTICE b/runtime/java/v21/NOTICE index e042b5d..e2bdd4e 100644 --- a/runtime/java/v21/NOTICE +++ b/runtime/java/v21/NOTICE @@ -29,9 +29,6 @@ Operating-system packages and base runtime *** SEE WARN *** * python ((Ubuntu focal)) License: PSF-2.0 - * vim ((Ubuntu focal)) - License: Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v21/WARN b/runtime/java/v21/WARN index cc48e17..0315e03 100644 --- a/runtime/java/v21/WARN +++ b/runtime/java/v21/WARN @@ -27,19 +27,6 @@ disclosed below but are not redistributed by the ASF in source form. Category X components that this Dockerfile ADDS on purpose must be removed. -============================================================================== -CATEGORY X -============================================================================== - - Component : vim - License : Vim License (charityware) - Category : X - Action : - The Vim licence is GPL-compatible but is not on the ASF Category A list and - contains a charityware clause. It is a developer convenience only. - REMOVE `vim` from the apt install list. - - ============================================================================== CATEGORY X (as bundled) ============================================================================== @@ -75,7 +62,7 @@ CATEGORY X (as bundled) SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] vim -- Vim License (charityware) + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES diff --git a/runtime/java/v8/Dockerfile b/runtime/java/v8/Dockerfile index 923f4ca..bea82a9 100644 --- a/runtime/java/v8/Dockerfile +++ b/runtime/java/v8/Dockerfile @@ -62,6 +62,6 @@ ENV OW_COMPILER=/bin/compile ENV OW_SAVE_JAR=exec.jar # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/java/v8/LICENSE b/runtime/java/v8/LICENSE index f87d083..64a520b 100644 --- a/runtime/java/v8/LICENSE +++ b/runtime/java/v8/LICENSE @@ -249,9 +249,6 @@ MIT PSF-2.0 python ((Ubuntu focal)) -Vim License (charityware) - vim ((Ubuntu focal)) - mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -271,8 +268,6 @@ Operating-system packages and base runtime locales (glibc) ((Ubuntu focal)) -- GPL-2.0-or-later AND LGPL-2.1-or-later *** SEE WARN *** python ((Ubuntu focal)) -- PSF-2.0 - vim ((Ubuntu focal)) -- Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v8/NOTICE b/runtime/java/v8/NOTICE index 9cf6e15..097de3d 100644 --- a/runtime/java/v8/NOTICE +++ b/runtime/java/v8/NOTICE @@ -29,9 +29,6 @@ Operating-system packages and base runtime *** SEE WARN *** * python ((Ubuntu focal)) License: PSF-2.0 - * vim ((Ubuntu focal)) - License: Vim License (charityware) - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- diff --git a/runtime/java/v8/WARN b/runtime/java/v8/WARN index a23d9ba..c768df4 100644 --- a/runtime/java/v8/WARN +++ b/runtime/java/v8/WARN @@ -27,19 +27,6 @@ disclosed below but are not redistributed by the ASF in source form. Category X components that this Dockerfile ADDS on purpose must be removed. -============================================================================== -CATEGORY X -============================================================================== - - Component : vim - License : Vim License (charityware) - Category : X - Action : - The Vim licence is GPL-compatible but is not on the ASF Category A list and - contains a charityware clause. It is a developer convenience only. - REMOVE `vim` from the apt install list. - - ============================================================================== CATEGORY X (as bundled) ============================================================================== @@ -75,7 +62,7 @@ CATEGORY X (as bundled) SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] vim -- Vim License (charityware) + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES diff --git a/runtime/nodejs/v20/Dockerfile b/runtime/nodejs/v20/Dockerfile index 0bae583..05b5eb6 100644 --- a/runtime/nodejs/v20/Dockerfile +++ b/runtime/nodejs/v20/Dockerfile @@ -49,6 +49,6 @@ EXPOSE 8080 USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/nodejs/v20/LICENSE b/runtime/nodejs/v20/LICENSE index 6000e03..6162d6e 100644 --- a/runtime/nodejs/v20/LICENSE +++ b/runtime/nodejs/v20/LICENSE @@ -221,10 +221,10 @@ Summary by license ------------------------------------------------------------------------------ Apache-2.0 - minio (^7.1.3) - mongodb (^6.4.0) - openai (^4.28.4) - openwhisk (^3.21.8) + minio (^8.0.7) + mongodb (^7.6.0) + openai (^7.10.0) + openwhisk (^3.21.9) Apache-2.0 AND MIT gopkg.in/yaml.v3 (v3.0.1) @@ -244,21 +244,16 @@ Info-ZIP unzip ((Debian bookworm)) MIT - @azure/openai (^1.0.0-beta.11) - @langchain/community (^0.0.34) + aws-s3 (^2.0.5) github.com/mattn/go-colorable (v0.1.13) github.com/mattn/go-isatty (v0.0.20) github.com/rs/zerolog (v1.33.0) github.com/stretchr/testify (v1.9.0) graphicsmagick ((Debian bookworm)) - ollama (^0.5.0) - pg (^8.11.3) - plotly (^1.0.6) - redis (^4.6.13) - uuid (^9.0.1) - -NO LICENSE DECLARED - node-auth0 (^1.0.0) + ollama (^0.6.3) + pg (^8.23.0) + redis (^6.2.1) + uuid (^14.0.2) mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -269,20 +264,16 @@ Detail by component npm dependencies preinstalled in the image (package.json) --------------------------------------------------------- - @azure/openai (^1.0.0-beta.11) -- MIT - @langchain/community (^0.0.34) -- MIT - minio (^7.1.3) -- Apache-2.0 - mongodb (^6.4.0) -- Apache-2.0 - node-auth0 (^1.0.0) -- NO LICENSE DECLARED - *** SEE WARN *** deprecated placeholder package. - ollama (^0.5.0) -- MIT - openai (^4.28.4) -- Apache-2.0 - openwhisk (^3.21.8) -- Apache-2.0 + aws-s3 (^2.0.5) -- MIT + minio (^8.0.7) -- Apache-2.0 + mongodb (^7.6.0) -- Apache-2.0 + ollama (^0.6.3) -- MIT + openai (^7.10.0) -- Apache-2.0 + openwhisk (^3.21.9) -- Apache-2.0 Apache OpenWhisk. - pg (^8.11.3) -- MIT - plotly (^1.0.6) -- MIT - redis (^4.6.13) -- MIT - uuid (^9.0.1) -- MIT + pg (^8.23.0) -- MIT + redis (^6.2.1) -- MIT + uuid (^14.0.2) -- MIT Operating-system packages installed by the Dockerfile ----------------------------------------------------- @@ -329,4 +320,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/nodejs/v20/NOTICE b/runtime/nodejs/v20/NOTICE index 30f89a9..ddda71d 100644 --- a/runtime/nodejs/v20/NOTICE +++ b/runtime/nodejs/v20/NOTICE @@ -15,31 +15,24 @@ listed in the WARN file as incompatible with the Apache License 2.0. npm dependencies preinstalled in the image (package.json) --------------------------------------------------------- - * @azure/openai (^1.0.0-beta.11) + * aws-s3 (^2.0.5) License: MIT - * @langchain/community (^0.0.34) - License: MIT - * minio (^7.1.3) + * minio (^8.0.7) License: Apache-2.0 - * mongodb (^6.4.0) + * mongodb (^7.6.0) License: Apache-2.0 - * node-auth0 (^1.0.0) - License: NO LICENSE DECLARED - *** SEE WARN *** deprecated placeholder package. - * ollama (^0.5.0) + * ollama (^0.6.3) License: MIT - * openai (^4.28.4) + * openai (^7.10.0) License: Apache-2.0 - * openwhisk (^3.21.8) + * openwhisk (^3.21.9) License: Apache-2.0 Apache OpenWhisk. - * pg (^8.11.3) - License: MIT - * plotly (^1.0.6) + * pg (^8.23.0) License: MIT - * redis (^4.6.13) + * redis (^6.2.1) License: MIT - * uuid (^9.0.1) + * uuid (^14.0.2) License: MIT Operating-system packages installed by the Dockerfile @@ -96,4 +89,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/nodejs/v20/WARN b/runtime/nodejs/v20/WARN index 90c392d..7096395 100644 --- a/runtime/nodejs/v20/WARN +++ b/runtime/nodejs/v20/WARN @@ -28,20 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : node-auth0 - License : NO LICENSE DECLARED - Category : X - Action : - The npm package `[email protected]` declares no licence at all and is marked - deprecated upstream. Unlicensed code may never be redistributed by the ASF. - REMOVE it from package.json; use the maintained `auth0` package (MIT) instead. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -58,6 +45,12 @@ CATEGORY X (as bundled) CATEGORY A ============================================================================== + Component : zip / unzip (Info-ZIP) + License : Info-ZIP License + Category : A + Action : + BSD-like and Apache-compatible. No action required. + Component : imagemagick / graphicsmagick License : ImageMagick License / MIT Category : A @@ -65,26 +58,21 @@ CATEGORY A Both are Apache-2.0 compatible. Note that ImageMagick delegate libraries may pull in additional licences; verify the delegate set if the image is audited in depth. - Component : zip / unzip (Info-ZIP) - License : Info-ZIP License - Category : A - Action : - BSD-like and Apache-compatible. No action required. - ============================================================================== SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] node-auth0 -- NO LICENSE DECLARED + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== Base image: node:20.11.1-bookworm (Node.js is MIT licensed). +The unlicensed `node-auth0` package flagged in earlier revisions of this +file is no longer in package.json. The npm dependency tree resolved by `npm install` is far larger than the direct dependencies listed here. Run `npm ls --all` or a license scanner inside the built image for the complete transitive inventory before an official release audit. - diff --git a/runtime/nodejs/v22/Dockerfile b/runtime/nodejs/v22/Dockerfile index d2c38ce..5c42957 100644 --- a/runtime/nodejs/v22/Dockerfile +++ b/runtime/nodejs/v22/Dockerfile @@ -49,6 +49,6 @@ EXPOSE 8080 USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/nodejs/v22/LICENSE b/runtime/nodejs/v22/LICENSE index c4b4079..30ae364 100644 --- a/runtime/nodejs/v22/LICENSE +++ b/runtime/nodejs/v22/LICENSE @@ -204,7 +204,7 @@ ============================================================================== LICENSES OF BUNDLED THIRD-PARTY SOFTWARE -Container image: apache/openserverless-runtime-nodejs:v21 +Container image: apache/openserverless-runtime-nodejs:v22 ============================================================================== Apache OpenServerless itself is licensed under the Apache License, @@ -221,10 +221,10 @@ Summary by license ------------------------------------------------------------------------------ Apache-2.0 - minio (^7.1.3) - mongodb (^6.4.0) - openai (^4.28.4) - openwhisk (^3.21.8) + minio (^8.0.7) + mongodb (^7.6.0) + openai (^7.10.0) + openwhisk (^3.21.9) Apache-2.0 AND MIT gopkg.in/yaml.v3 (v3.0.1) @@ -244,21 +244,16 @@ Info-ZIP unzip ((Debian bookworm)) MIT - @azure/openai (^1.0.0-beta.11) - @langchain/community (^0.0.34) + aws-s3 (^2.0.5) github.com/mattn/go-colorable (v0.1.13) github.com/mattn/go-isatty (v0.0.20) github.com/rs/zerolog (v1.33.0) github.com/stretchr/testify (v1.9.0) graphicsmagick ((Debian bookworm)) - ollama (^0.5.0) - pg (^8.11.3) - plotly (^1.0.6) - redis (^4.6.13) - uuid (^9.0.1) - -NO LICENSE DECLARED - node-auth0 (^1.0.0) + ollama (^0.6.3) + pg (^8.23.0) + redis (^6.2.1) + uuid (^14.0.2) mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -269,20 +264,16 @@ Detail by component npm dependencies preinstalled in the image (package.json) --------------------------------------------------------- - @azure/openai (^1.0.0-beta.11) -- MIT - @langchain/community (^0.0.34) -- MIT - minio (^7.1.3) -- Apache-2.0 - mongodb (^6.4.0) -- Apache-2.0 - node-auth0 (^1.0.0) -- NO LICENSE DECLARED - *** SEE WARN *** deprecated placeholder package. - ollama (^0.5.0) -- MIT - openai (^4.28.4) -- Apache-2.0 - openwhisk (^3.21.8) -- Apache-2.0 + aws-s3 (^2.0.5) -- MIT + minio (^8.0.7) -- Apache-2.0 + mongodb (^7.6.0) -- Apache-2.0 + ollama (^0.6.3) -- MIT + openai (^7.10.0) -- Apache-2.0 + openwhisk (^3.21.9) -- Apache-2.0 Apache OpenWhisk. - pg (^8.11.3) -- MIT - plotly (^1.0.6) -- MIT - redis (^4.6.13) -- MIT - uuid (^9.0.1) -- MIT + pg (^8.23.0) -- MIT + redis (^6.2.1) -- MIT + uuid (^14.0.2) -- MIT Operating-system packages installed by the Dockerfile ----------------------------------------------------- @@ -329,4 +320,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/nodejs/v22/NOTICE b/runtime/nodejs/v22/NOTICE index 9e41b63..f999652 100644 --- a/runtime/nodejs/v22/NOTICE +++ b/runtime/nodejs/v22/NOTICE @@ -5,7 +5,7 @@ This product includes software developed at The Apache Software Foundation (http://www.apache.org/). ------------------------------------------------------------------------------ -Container image: apache/openserverless-runtime-nodejs:v21 +Container image: apache/openserverless-runtime-nodejs:v22 ------------------------------------------------------------------------------ This image bundles third-party software. The components below are @@ -15,31 +15,24 @@ listed in the WARN file as incompatible with the Apache License 2.0. npm dependencies preinstalled in the image (package.json) --------------------------------------------------------- - * @azure/openai (^1.0.0-beta.11) + * aws-s3 (^2.0.5) License: MIT - * @langchain/community (^0.0.34) - License: MIT - * minio (^7.1.3) + * minio (^8.0.7) License: Apache-2.0 - * mongodb (^6.4.0) + * mongodb (^7.6.0) License: Apache-2.0 - * node-auth0 (^1.0.0) - License: NO LICENSE DECLARED - *** SEE WARN *** deprecated placeholder package. - * ollama (^0.5.0) + * ollama (^0.6.3) License: MIT - * openai (^4.28.4) + * openai (^7.10.0) License: Apache-2.0 - * openwhisk (^3.21.8) + * openwhisk (^3.21.9) License: Apache-2.0 Apache OpenWhisk. - * pg (^8.11.3) - License: MIT - * plotly (^1.0.6) + * pg (^8.23.0) License: MIT - * redis (^4.6.13) + * redis (^6.2.1) License: MIT - * uuid (^9.0.1) + * uuid (^14.0.2) License: MIT Operating-system packages installed by the Dockerfile @@ -96,4 +89,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/nodejs/v22/WARN b/runtime/nodejs/v22/WARN index f259ead..61a5872 100644 --- a/runtime/nodejs/v22/WARN +++ b/runtime/nodejs/v22/WARN @@ -1,6 +1,6 @@ ============================================================================== WARN -- Apache License 2.0 incompatibilities -Container image: apache/openserverless-runtime-nodejs:v21 +Container image: apache/openserverless-runtime-nodejs:v22 ============================================================================== This file lists third-party components bundled by the Dockerfile beside @@ -28,20 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : node-auth0 - License : NO LICENSE DECLARED - Category : X - Action : - The npm package `[email protected]` declares no licence at all and is marked - deprecated upstream. Unlicensed code may never be redistributed by the ASF. - REMOVE it from package.json; use the maintained `auth0` package (MIT) instead. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -58,6 +45,12 @@ CATEGORY X (as bundled) CATEGORY A ============================================================================== + Component : zip / unzip (Info-ZIP) + License : Info-ZIP License + Category : A + Action : + BSD-like and Apache-compatible. No action required. + Component : imagemagick / graphicsmagick License : ImageMagick License / MIT Category : A @@ -65,26 +58,21 @@ CATEGORY A Both are Apache-2.0 compatible. Note that ImageMagick delegate libraries may pull in additional licences; verify the delegate set if the image is audited in depth. - Component : zip / unzip (Info-ZIP) - License : Info-ZIP License - Category : A - Action : - BSD-like and Apache-compatible. No action required. - ============================================================================== SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] node-auth0 -- NO LICENSE DECLARED + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: node:21.6.2-bookworm (Node.js is MIT licensed). +Base image: node:22.23.2-bookworm (Node.js is MIT licensed). +The unlicensed `node-auth0` package flagged in earlier revisions of this +file is no longer in package.json. The npm dependency tree resolved by `npm install` is far larger than the direct dependencies listed here. Run `npm ls --all` or a license scanner inside the built image for the complete transitive inventory before an official release audit. - diff --git a/runtime/nodejs/v24/Dockerfile b/runtime/nodejs/v24/Dockerfile index 093c441..ef5ce77 100644 --- a/runtime/nodejs/v24/Dockerfile +++ b/runtime/nodejs/v24/Dockerfile @@ -49,6 +49,6 @@ EXPOSE 8080 USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/nodejs/v24/LICENSE b/runtime/nodejs/v24/LICENSE index c4b4079..b77514f 100644 --- a/runtime/nodejs/v24/LICENSE +++ b/runtime/nodejs/v24/LICENSE @@ -204,7 +204,7 @@ ============================================================================== LICENSES OF BUNDLED THIRD-PARTY SOFTWARE -Container image: apache/openserverless-runtime-nodejs:v21 +Container image: apache/openserverless-runtime-nodejs:v24 ============================================================================== Apache OpenServerless itself is licensed under the Apache License, @@ -221,10 +221,10 @@ Summary by license ------------------------------------------------------------------------------ Apache-2.0 - minio (^7.1.3) - mongodb (^6.4.0) - openai (^4.28.4) - openwhisk (^3.21.8) + minio (^8.0.7) + mongodb (^7.6.0) + openai (^7.10.0) + openwhisk (^3.21.9) Apache-2.0 AND MIT gopkg.in/yaml.v3 (v3.0.1) @@ -244,21 +244,16 @@ Info-ZIP unzip ((Debian bookworm)) MIT - @azure/openai (^1.0.0-beta.11) - @langchain/community (^0.0.34) + aws-s3 (^2.0.5) github.com/mattn/go-colorable (v0.1.13) github.com/mattn/go-isatty (v0.0.20) github.com/rs/zerolog (v1.33.0) github.com/stretchr/testify (v1.9.0) graphicsmagick ((Debian bookworm)) - ollama (^0.5.0) - pg (^8.11.3) - plotly (^1.0.6) - redis (^4.6.13) - uuid (^9.0.1) - -NO LICENSE DECLARED - node-auth0 (^1.0.0) + ollama (^0.6.3) + pg (^8.23.0) + redis (^6.2.1) + uuid (^14.0.2) mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -269,20 +264,16 @@ Detail by component npm dependencies preinstalled in the image (package.json) --------------------------------------------------------- - @azure/openai (^1.0.0-beta.11) -- MIT - @langchain/community (^0.0.34) -- MIT - minio (^7.1.3) -- Apache-2.0 - mongodb (^6.4.0) -- Apache-2.0 - node-auth0 (^1.0.0) -- NO LICENSE DECLARED - *** SEE WARN *** deprecated placeholder package. - ollama (^0.5.0) -- MIT - openai (^4.28.4) -- Apache-2.0 - openwhisk (^3.21.8) -- Apache-2.0 + aws-s3 (^2.0.5) -- MIT + minio (^8.0.7) -- Apache-2.0 + mongodb (^7.6.0) -- Apache-2.0 + ollama (^0.6.3) -- MIT + openai (^7.10.0) -- Apache-2.0 + openwhisk (^3.21.9) -- Apache-2.0 Apache OpenWhisk. - pg (^8.11.3) -- MIT - plotly (^1.0.6) -- MIT - redis (^4.6.13) -- MIT - uuid (^9.0.1) -- MIT + pg (^8.23.0) -- MIT + redis (^6.2.1) -- MIT + uuid (^14.0.2) -- MIT Operating-system packages installed by the Dockerfile ----------------------------------------------------- @@ -329,4 +320,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/nodejs/v24/NOTICE b/runtime/nodejs/v24/NOTICE index 9e41b63..acfee4b 100644 --- a/runtime/nodejs/v24/NOTICE +++ b/runtime/nodejs/v24/NOTICE @@ -5,7 +5,7 @@ This product includes software developed at The Apache Software Foundation (http://www.apache.org/). ------------------------------------------------------------------------------ -Container image: apache/openserverless-runtime-nodejs:v21 +Container image: apache/openserverless-runtime-nodejs:v24 ------------------------------------------------------------------------------ This image bundles third-party software. The components below are @@ -15,31 +15,24 @@ listed in the WARN file as incompatible with the Apache License 2.0. npm dependencies preinstalled in the image (package.json) --------------------------------------------------------- - * @azure/openai (^1.0.0-beta.11) + * aws-s3 (^2.0.5) License: MIT - * @langchain/community (^0.0.34) - License: MIT - * minio (^7.1.3) + * minio (^8.0.7) License: Apache-2.0 - * mongodb (^6.4.0) + * mongodb (^7.6.0) License: Apache-2.0 - * node-auth0 (^1.0.0) - License: NO LICENSE DECLARED - *** SEE WARN *** deprecated placeholder package. - * ollama (^0.5.0) + * ollama (^0.6.3) License: MIT - * openai (^4.28.4) + * openai (^7.10.0) License: Apache-2.0 - * openwhisk (^3.21.8) + * openwhisk (^3.21.9) License: Apache-2.0 Apache OpenWhisk. - * pg (^8.11.3) - License: MIT - * plotly (^1.0.6) + * pg (^8.23.0) License: MIT - * redis (^4.6.13) + * redis (^6.2.1) License: MIT - * uuid (^9.0.1) + * uuid (^14.0.2) License: MIT Operating-system packages installed by the Dockerfile @@ -96,4 +89,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/nodejs/v24/WARN b/runtime/nodejs/v24/WARN index f259ead..ed5aecc 100644 --- a/runtime/nodejs/v24/WARN +++ b/runtime/nodejs/v24/WARN @@ -1,6 +1,6 @@ ============================================================================== WARN -- Apache License 2.0 incompatibilities -Container image: apache/openserverless-runtime-nodejs:v21 +Container image: apache/openserverless-runtime-nodejs:v24 ============================================================================== This file lists third-party components bundled by the Dockerfile beside @@ -28,20 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : node-auth0 - License : NO LICENSE DECLARED - Category : X - Action : - The npm package `[email protected]` declares no licence at all and is marked - deprecated upstream. Unlicensed code may never be redistributed by the ASF. - REMOVE it from package.json; use the maintained `auth0` package (MIT) instead. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -58,6 +45,12 @@ CATEGORY X (as bundled) CATEGORY A ============================================================================== + Component : zip / unzip (Info-ZIP) + License : Info-ZIP License + Category : A + Action : + BSD-like and Apache-compatible. No action required. + Component : imagemagick / graphicsmagick License : ImageMagick License / MIT Category : A @@ -65,26 +58,21 @@ CATEGORY A Both are Apache-2.0 compatible. Note that ImageMagick delegate libraries may pull in additional licences; verify the delegate set if the image is audited in depth. - Component : zip / unzip (Info-ZIP) - License : Info-ZIP License - Category : A - Action : - BSD-like and Apache-compatible. No action required. - ============================================================================== SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] node-auth0 -- NO LICENSE DECLARED + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: node:21.6.2-bookworm (Node.js is MIT licensed). +Base image: node:24.20.0-bookworm (Node.js is MIT licensed). +The unlicensed `node-auth0` package flagged in earlier revisions of this +file is no longer in package.json. The npm dependency tree resolved by `npm install` is far larger than the direct dependencies listed here. Run `npm ls --all` or a license scanner inside the built image for the complete transitive inventory before an official release audit. - diff --git a/runtime/php/v8.2/Dockerfile b/runtime/php/v8.2/Dockerfile index e3d4509..a0c2c8c 100644 --- a/runtime/php/v8.2/Dockerfile +++ b/runtime/php/v8.2/Dockerfile @@ -95,6 +95,6 @@ ENV OW_COMPILER=/bin/compile.php ENV OW_EXECUTION_ENV=apacheopenserverless/action-php-v8.2 # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT [ "/bin/proxy" ] diff --git a/runtime/php/v8.3/Dockerfile b/runtime/php/v8.3/Dockerfile index 159e425..ed7a319 100644 --- a/runtime/php/v8.3/Dockerfile +++ b/runtime/php/v8.3/Dockerfile @@ -97,6 +97,6 @@ ENV OW_COMPILER=/bin/compile.php ENV OW_EXECUTION_ENV=apacheopenserverless/action-php-v8.3 # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT [ "/bin/proxy", "-debug" ] \ No newline at end of file diff --git a/runtime/python/v3.11/Dockerfile b/runtime/python/v3.11/Dockerfile index 53df6ad..1397770 100644 --- a/runtime/python/v3.11/Dockerfile +++ b/runtime/python/v3.11/Dockerfile @@ -51,6 +51,6 @@ WORKDIR /action RUN chown nobody:root /action ; chmod 0775 /action USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/python/v3.11/LICENSE b/runtime/python/v3.11/LICENSE index 1db6e57..99bcac7 100644 --- a/runtime/python/v3.11/LICENSE +++ b/runtime/python/v3.11/LICENSE @@ -221,41 +221,36 @@ Summary by license ------------------------------------------------------------------------------ Apache-2.0 - bcrypt (4.2.1) - boto3 (1.28.25) - farm-haystack (1.23.0) - kafka_python (2.0.2) + bcrypt (5.0.0) + boto3 (1.43.89) + farm-haystack (1.18.0) + kafka_python (3.0.11) langdetect (1.0.9) - minio (7.1.16) - nltk (3.8.1) - openai (1.7.1) - pymongo (4.4.1) - requests (2.31.0) + minio (7.2.20) + nltk (3.10.3) + openai (3.8.0) + pymongo (4.18.0) + requests (2.34.2) Apache-2.0 AND MIT gopkg.in/yaml.v3 (v3.0.1) Apache-2.0 OR BSD-3-Clause - python-dateutil (2.8.2) + python-dateutil (2.9.0.post0) BSD-2-Clause - feedparser (6.0.11) + feedparser (6.0.14) BSD-3-Clause github.com/google/uuid (v1.6.0) github.com/pmezard/go-difflib (v1.0.0) golang.org/x/sys (v0.26.0) - joblib (1.4.2) - numpy (1.26.4) + joblib (1.6.0) + numpy (2.4.6) pg8000 (1.31.5) - scikit-learn (1.5.2) - scrapy (2.5.0) - -BSD-3-Clause (bundles libxml2/libxslt, MIT) python3-lxml ((Debian bookworm)) - -GPL-2.0 OR GPL-3.0 - xpdf ((Debian bookworm)) + scikit-learn (1.9.0) + scrapy (2.18.0) ISC github.com/davecgh/go-spew (v1.1.1) @@ -263,28 +258,24 @@ ISC Info-ZIP zip ((Debian bookworm)) -LGPL-3.0-or-later - python3-psycopg2 ((Debian bookworm)) - MIT - auth0-python (4.6.0) - beautifulsoup4 (4.10.0) + beautifulsoup4 (4.15.0) github.com/mattn/go-colorable (v0.1.13) github.com/mattn/go-isatty (v0.0.20) github.com/rs/zerolog (v1.33.0) github.com/stretchr/testify (v1.9.0) - httplib2 (0.19.1) - langchain (0.1.0) - lightgbm (4.5.0) + httplib2 (0.32.0) + langchain (1.4.0) + lightgbm (4.7.0) netifaces (0.11.0) - ollama (0.1.9) - plotly (5.19.0) - pyyaml (6.0) - redis (4.4.2) - twisted (21.7.0) + ollama (0.6.2) + plotly (7.0.0) + pyyaml (6.0.3) + redis (8.1.0) + twisted (26.4.0) MIT OR AFL-2.1 - simplejson (3.17.5) + simplejson (4.1.2) mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -293,46 +284,42 @@ mixed; see WARN Detail by component ------------------------------------------------------------------------------ -Python packages preinstalled in the image (requirements.txt) ------------------------------------------------------------- - beautifulsoup4 (4.10.0) -- MIT - httplib2 (0.19.1) -- MIT - kafka_python (2.0.2) -- Apache-2.0 - python-dateutil (2.8.2) -- Apache-2.0 OR BSD-3-Clause - requests (2.31.0) -- Apache-2.0 - scrapy (2.5.0) -- BSD-3-Clause - simplejson (3.17.5) -- MIT OR AFL-2.1 - twisted (21.7.0) -- MIT +Python packages preinstalled in the image (requirements.in) +----------------------------------------------------------- + beautifulsoup4 (4.15.0) -- MIT + httplib2 (0.32.0) -- MIT + kafka_python (3.0.11) -- Apache-2.0 + python-dateutil (2.9.0.post0) -- Apache-2.0 OR BSD-3-Clause + requests (2.34.2) -- Apache-2.0 + scrapy (2.18.0) -- BSD-3-Clause + simplejson (4.1.2) -- MIT OR AFL-2.1 + Dual-licensed; the MIT option is elected. See WARN. + twisted (26.4.0) -- MIT netifaces (0.11.0) -- MIT - pyyaml (6.0) -- MIT - redis (4.4.2) -- MIT - boto3 (1.28.25) -- Apache-2.0 + pyyaml (6.0.3) -- MIT + redis (8.1.0) -- MIT + boto3 (1.43.89) -- Apache-2.0 pg8000 (1.31.5) -- BSD-3-Clause - pymongo (4.4.1) -- Apache-2.0 - minio (7.1.16) -- Apache-2.0 - openai (1.7.1) -- Apache-2.0 - auth0-python (4.6.0) -- MIT - langchain (0.1.0) -- MIT - farm-haystack (1.23.0) -- Apache-2.0 - nltk (3.8.1) -- Apache-2.0 + pymongo (4.18.0) -- Apache-2.0 + minio (7.2.20) -- Apache-2.0 + openai (3.8.0) -- Apache-2.0 + langchain (1.4.0) -- MIT + farm-haystack (1.18.0) -- Apache-2.0 + nltk (3.10.3) -- Apache-2.0 langdetect (1.0.9) -- Apache-2.0 - plotly (5.19.0) -- MIT - ollama (0.1.9) -- MIT - joblib (1.4.2) -- BSD-3-Clause - lightgbm (4.5.0) -- MIT - feedparser (6.0.11) -- BSD-2-Clause - numpy (1.26.4) -- BSD-3-Clause - scikit-learn (1.5.2) -- BSD-3-Clause - bcrypt (4.2.1) -- Apache-2.0 + plotly (7.0.0) -- MIT + ollama (0.6.2) -- MIT + joblib (1.6.0) -- BSD-3-Clause + lightgbm (4.7.0) -- MIT + feedparser (6.0.14) -- BSD-2-Clause + numpy (2.4.6) -- BSD-3-Clause + scikit-learn (1.9.0) -- BSD-3-Clause + bcrypt (5.0.0) -- Apache-2.0 Operating-system packages installed by the Dockerfile ----------------------------------------------------- - python3-lxml ((Debian bookworm)) -- BSD-3-Clause (bundles libxml2/libxslt, MIT) - python3-psycopg2 ((Debian bookworm)) -- LGPL-3.0-or-later - *** SEE WARN *** + python3-lxml ((Debian bookworm)) -- BSD-3-Clause zip ((Debian bookworm)) -- Info-ZIP - xpdf ((Debian bookworm)) -- GPL-2.0 OR GPL-3.0 - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -373,4 +360,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/python/v3.11/NOTICE b/runtime/python/v3.11/NOTICE index 61384a0..eca589b 100644 --- a/runtime/python/v3.11/NOTICE +++ b/runtime/python/v3.11/NOTICE @@ -13,79 +13,72 @@ redistributed under the licenses recorded in the LICENSE file that accompanies this NOTICE. Components flagged '*** SEE WARN ***' are listed in the WARN file as incompatible with the Apache License 2.0. -Python packages preinstalled in the image (requirements.txt) ------------------------------------------------------------- - * beautifulsoup4 (4.10.0) +Python packages preinstalled in the image (requirements.in) +----------------------------------------------------------- + * beautifulsoup4 (4.15.0) License: MIT - * httplib2 (0.19.1) + * httplib2 (0.32.0) License: MIT - * kafka_python (2.0.2) + * kafka_python (3.0.11) License: Apache-2.0 - * python-dateutil (2.8.2) + * python-dateutil (2.9.0.post0) License: Apache-2.0 OR BSD-3-Clause - * requests (2.31.0) + * requests (2.34.2) License: Apache-2.0 - * scrapy (2.5.0) + * scrapy (2.18.0) License: BSD-3-Clause - * simplejson (3.17.5) + * simplejson (4.1.2) License: MIT OR AFL-2.1 - * twisted (21.7.0) + Dual-licensed; the MIT option is elected. See WARN. + * twisted (26.4.0) License: MIT * netifaces (0.11.0) License: MIT - * pyyaml (6.0) + * pyyaml (6.0.3) License: MIT - * redis (4.4.2) + * redis (8.1.0) License: MIT - * boto3 (1.28.25) + * boto3 (1.43.89) License: Apache-2.0 * pg8000 (1.31.5) License: BSD-3-Clause - * pymongo (4.4.1) + * pymongo (4.18.0) License: Apache-2.0 - * minio (7.1.16) + * minio (7.2.20) License: Apache-2.0 - * openai (1.7.1) + * openai (3.8.0) License: Apache-2.0 - * auth0-python (4.6.0) + * langchain (1.4.0) License: MIT - * langchain (0.1.0) - License: MIT - * farm-haystack (1.23.0) + * farm-haystack (1.18.0) License: Apache-2.0 - * nltk (3.8.1) + * nltk (3.10.3) License: Apache-2.0 * langdetect (1.0.9) License: Apache-2.0 - * plotly (5.19.0) + * plotly (7.0.0) License: MIT - * ollama (0.1.9) + * ollama (0.6.2) License: MIT - * joblib (1.4.2) + * joblib (1.6.0) License: BSD-3-Clause - * lightgbm (4.5.0) + * lightgbm (4.7.0) License: MIT - * feedparser (6.0.11) + * feedparser (6.0.14) License: BSD-2-Clause - * numpy (1.26.4) + * numpy (2.4.6) License: BSD-3-Clause - * scikit-learn (1.5.2) + * scikit-learn (1.9.0) License: BSD-3-Clause - * bcrypt (4.2.1) + * bcrypt (5.0.0) License: Apache-2.0 Operating-system packages installed by the Dockerfile ----------------------------------------------------- * python3-lxml ((Debian bookworm)) - License: BSD-3-Clause (bundles libxml2/libxslt, MIT) - * python3-psycopg2 ((Debian bookworm)) - License: LGPL-3.0-or-later - *** SEE WARN *** + License: BSD-3-Clause * zip ((Debian bookworm)) License: Info-ZIP - * xpdf ((Debian bookworm)) - License: GPL-2.0 OR GPL-3.0 - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -132,4 +125,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/python/v3.11/WARN b/runtime/python/v3.11/WARN index 9572a49..d1beaa7 100644 --- a/runtime/python/v3.11/WARN +++ b/runtime/python/v3.11/WARN @@ -28,27 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : python3-psycopg2 (Debian package) - License : LGPL-3.0-or-later - Category : X - Action : - Installed via apt and shipped inside the image. LGPL is Category X. - REMOVE it from the apt install list, or swap for an Apache-compatible driver. - - Component : xpdf - License : GPL-2.0 OR GPL-3.0 - Category : X - Action : - GPL is Category X and may not be redistributed in an ASF convenience binary. - REMOVE `xpdf` from the apt install list. If PDF text extraction is required, use - an Apache-compatible library such as Apache PDFBox or pypdf (BSD-3-Clause). - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -73,7 +53,7 @@ CATEGORY A ============================================================================== -CATEGORY A (under MIT) +CATEGORY A (UNDER MIT) ============================================================================== Component : simplejson @@ -87,15 +67,16 @@ CATEGORY A (under MIT) SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] python3-psycopg2 (Debian package) -- LGPL-3.0-or-later - [x] xpdf -- GPL-2.0 OR GPL-3.0 + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: python:3.11.8-bookworm (CPython under the PSF License 2.0). +Base image: python:3.11.16-bookworm (CPython under the PSF License 2.0). +The `chess`, `xpdf` and `python3-psycopg2` components flagged in earlier +revisions of this file are no longer installed by this runtime. The pip dependency tree resolved from requirements.txt is far larger than -the pinned direct requirements listed here. Run `pip-licenses` inside the -built image for the complete transitive inventory before a release audit. - +the direct requirements listed here; requirements.txt records the full +pinned closure. Run `pip-licenses` inside the built image for the +complete inventory before a release audit. diff --git a/runtime/python/v3.12/Dockerfile b/runtime/python/v3.12/Dockerfile index 29e8f70..5a68db0 100644 --- a/runtime/python/v3.12/Dockerfile +++ b/runtime/python/v3.12/Dockerfile @@ -52,6 +52,6 @@ WORKDIR /action RUN chown nobody:root /action ; chmod 0775 /action USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/python/v3.12/LICENSE b/runtime/python/v3.12/LICENSE index d5741ec..72eba68 100644 --- a/runtime/python/v3.12/LICENSE +++ b/runtime/python/v3.12/LICENSE @@ -221,44 +221,36 @@ Summary by license ------------------------------------------------------------------------------ Apache-2.0 - bcrypt (4.2.1) - boto3 (1.35.98) - kafka_python (2.0.2) + bcrypt (5.0.0) + boto3 (1.43.89) + kafka_python (3.0.11) langdetect (1.0.9) - minio (7.1.16) - nltk (3.8.1) - openai (1.59.3) - pymilvus (2.5.3) - pymongo (4.4.1) - requests (2.32.2) + minio (7.2.20) + nltk (3.10.3) + openai (3.8.0) + pymilvus (3.0.1) + pymongo (4.18.0) + requests (2.34.2) Apache-2.0 AND MIT gopkg.in/yaml.v3 (v3.0.1) Apache-2.0 OR BSD-3-Clause - python-dateutil (2.8.2) + python-dateutil (2.9.0.post0) BSD-2-Clause - feedparser (6.0.11) + feedparser (6.0.14) BSD-3-Clause github.com/google/uuid (v1.6.0) github.com/pmezard/go-difflib (v1.0.0) golang.org/x/sys (v0.26.0) - joblib (1.4.2) - numpy (1.26.4) + joblib (1.6.0) + numpy (2.5.2) pg8000 (1.31.5) - scikit-learn (1.5.2) - scrapy (2.5.0) - -BSD-3-Clause (bundles libxml2/libxslt, MIT) python3-lxml ((Debian bookworm)) - -GPL-2.0 OR GPL-3.0 - xpdf ((Debian bookworm)) - -GPL-3.0-or-later - chess (1.11.1) + scikit-learn (1.9.0) + scrapy (2.18.0) ISC github.com/davecgh/go-spew (v1.1.1) @@ -266,38 +258,33 @@ ISC Info-ZIP zip ((Debian bookworm)) -LGPL-3.0-or-later - python3-psycopg2 ((Debian bookworm)) - MIT - auth0-python (4.6.0) - beautifulsoup4 (4.10.0) + beautifulsoup4 (4.15.0) chevron (0.14.0) github.com/mattn/go-colorable (v0.1.13) github.com/mattn/go-isatty (v0.0.20) github.com/rs/zerolog (v1.33.0) github.com/stretchr/testify (v1.9.0) - httplib2 (0.19.1) - langchain (0.3.14) - langchain-anthropic (0.3.1) - langchain-milvus (0.1.7) - langchain-ollama (0.2.2) - langchain-openai (0.2.14) - langchain-postgres (0.0.12) - langchain-together (0.2.0) - lightgbm (4.5.0) + httplib2 (0.32.0) + langchain (1.4.0) + langchain-anthropic (1.7.1) + langchain-milvus (0.4.0) + langchain-ollama (1.1.0) + langchain-openai (1.6.0) + langchain-together (0.4.0) + lightgbm (4.7.0) netifaces (0.11.0) - ollama (0.4.5) - plotly (5.19.0) - pyyaml (6.0.2) - redis (5.2.1) - twisted (21.7.0) + ollama (0.6.2) + plotly (7.0.0) + pyyaml (6.0.3) + redis (8.1.0) + twisted (26.4.0) MIT OR AFL-2.1 - simplejson (3.17.5) + simplejson (4.1.2) MIT-CMU (HPND) - pillow (11.1.0) + pillow (12.3.0) mixed; see WARN (see the FROM line of the Dockerfile) (-) @@ -306,56 +293,49 @@ mixed; see WARN Detail by component ------------------------------------------------------------------------------ -Python packages preinstalled in the image (requirements.txt) ------------------------------------------------------------- - beautifulsoup4 (4.10.0) -- MIT - ollama (0.4.5) -- MIT - openai (1.59.3) -- Apache-2.0 - pymilvus (2.5.3) -- Apache-2.0 - redis (5.2.1) -- MIT - pillow (11.1.0) -- MIT-CMU (HPND) - nltk (3.8.1) -- Apache-2.0 - httplib2 (0.19.1) -- MIT - kafka_python (2.0.2) -- Apache-2.0 - python-dateutil (2.8.2) -- Apache-2.0 OR BSD-3-Clause - requests (2.32.2) -- Apache-2.0 - scrapy (2.5.0) -- BSD-3-Clause - simplejson (3.17.5) -- MIT OR AFL-2.1 - twisted (21.7.0) -- MIT +Python packages preinstalled in the image (requirements.in) +----------------------------------------------------------- + beautifulsoup4 (4.15.0) -- MIT + ollama (0.6.2) -- MIT + openai (3.8.0) -- Apache-2.0 + pymilvus (3.0.1) -- Apache-2.0 + redis (8.1.0) -- MIT + pillow (12.3.0) -- MIT-CMU (HPND) + nltk (3.10.3) -- Apache-2.0 + httplib2 (0.32.0) -- MIT + kafka_python (3.0.11) -- Apache-2.0 + python-dateutil (2.9.0.post0) -- Apache-2.0 OR BSD-3-Clause + requests (2.34.2) -- Apache-2.0 + scrapy (2.18.0) -- BSD-3-Clause + simplejson (4.1.2) -- MIT OR AFL-2.1 + Dual-licensed; the MIT option is elected. See WARN. + twisted (26.4.0) -- MIT netifaces (0.11.0) -- MIT - pyyaml (6.0.2) -- MIT - boto3 (1.35.98) -- Apache-2.0 + pyyaml (6.0.3) -- MIT + boto3 (1.43.89) -- Apache-2.0 pg8000 (1.31.5) -- BSD-3-Clause - pymongo (4.4.1) -- Apache-2.0 - minio (7.1.16) -- Apache-2.0 - auth0-python (4.6.0) -- MIT + pymongo (4.18.0) -- Apache-2.0 + minio (7.2.20) -- Apache-2.0 langdetect (1.0.9) -- Apache-2.0 - plotly (5.19.0) -- MIT - joblib (1.4.2) -- BSD-3-Clause - lightgbm (4.5.0) -- MIT - feedparser (6.0.11) -- BSD-2-Clause - numpy (1.26.4) -- BSD-3-Clause - scikit-learn (1.5.2) -- BSD-3-Clause - langchain (0.3.14) -- MIT - langchain-ollama (0.2.2) -- MIT - langchain-openai (0.2.14) -- MIT - langchain-anthropic (0.3.1) -- MIT - langchain-together (0.2.0) -- MIT - langchain-postgres (0.0.12) -- MIT - langchain-milvus (0.1.7) -- MIT - bcrypt (4.2.1) -- Apache-2.0 + plotly (7.0.0) -- MIT + joblib (1.6.0) -- BSD-3-Clause + lightgbm (4.7.0) -- MIT + feedparser (6.0.14) -- BSD-2-Clause + numpy (2.5.2) -- BSD-3-Clause + scikit-learn (1.9.0) -- BSD-3-Clause + langchain (1.4.0) -- MIT + langchain-ollama (1.1.0) -- MIT + langchain-openai (1.6.0) -- MIT + langchain-anthropic (1.7.1) -- MIT + langchain-together (0.4.0) -- MIT + langchain-milvus (0.4.0) -- MIT + bcrypt (5.0.0) -- Apache-2.0 chevron (0.14.0) -- MIT - chess (1.11.1) -- GPL-3.0-or-later - *** SEE WARN *** Operating-system packages installed by the Dockerfile ----------------------------------------------------- - python3-lxml ((Debian bookworm)) -- BSD-3-Clause (bundles libxml2/libxslt, MIT) - python3-psycopg2 ((Debian bookworm)) -- LGPL-3.0-or-later - *** SEE WARN *** + python3-lxml ((Debian bookworm)) -- BSD-3-Clause zip ((Debian bookworm)) -- Info-ZIP - xpdf ((Debian bookworm)) -- GPL-2.0 OR GPL-3.0 - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -396,4 +376,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/python/v3.12/NOTICE b/runtime/python/v3.12/NOTICE index bf4fe5f..13ea08b 100644 --- a/runtime/python/v3.12/NOTICE +++ b/runtime/python/v3.12/NOTICE @@ -13,98 +13,86 @@ redistributed under the licenses recorded in the LICENSE file that accompanies this NOTICE. Components flagged '*** SEE WARN ***' are listed in the WARN file as incompatible with the Apache License 2.0. -Python packages preinstalled in the image (requirements.txt) ------------------------------------------------------------- - * beautifulsoup4 (4.10.0) +Python packages preinstalled in the image (requirements.in) +----------------------------------------------------------- + * beautifulsoup4 (4.15.0) License: MIT - * ollama (0.4.5) + * ollama (0.6.2) License: MIT - * openai (1.59.3) + * openai (3.8.0) License: Apache-2.0 - * pymilvus (2.5.3) + * pymilvus (3.0.1) License: Apache-2.0 - * redis (5.2.1) + * redis (8.1.0) License: MIT - * pillow (11.1.0) + * pillow (12.3.0) License: MIT-CMU (HPND) - * nltk (3.8.1) + * nltk (3.10.3) License: Apache-2.0 - * httplib2 (0.19.1) + * httplib2 (0.32.0) License: MIT - * kafka_python (2.0.2) + * kafka_python (3.0.11) License: Apache-2.0 - * python-dateutil (2.8.2) + * python-dateutil (2.9.0.post0) License: Apache-2.0 OR BSD-3-Clause - * requests (2.32.2) + * requests (2.34.2) License: Apache-2.0 - * scrapy (2.5.0) + * scrapy (2.18.0) License: BSD-3-Clause - * simplejson (3.17.5) + * simplejson (4.1.2) License: MIT OR AFL-2.1 - * twisted (21.7.0) + Dual-licensed; the MIT option is elected. See WARN. + * twisted (26.4.0) License: MIT * netifaces (0.11.0) License: MIT - * pyyaml (6.0.2) + * pyyaml (6.0.3) License: MIT - * boto3 (1.35.98) + * boto3 (1.43.89) License: Apache-2.0 * pg8000 (1.31.5) License: BSD-3-Clause - * pymongo (4.4.1) + * pymongo (4.18.0) License: Apache-2.0 - * minio (7.1.16) + * minio (7.2.20) License: Apache-2.0 - * auth0-python (4.6.0) - License: MIT * langdetect (1.0.9) License: Apache-2.0 - * plotly (5.19.0) + * plotly (7.0.0) License: MIT - * joblib (1.4.2) + * joblib (1.6.0) License: BSD-3-Clause - * lightgbm (4.5.0) + * lightgbm (4.7.0) License: MIT - * feedparser (6.0.11) + * feedparser (6.0.14) License: BSD-2-Clause - * numpy (1.26.4) + * numpy (2.5.2) License: BSD-3-Clause - * scikit-learn (1.5.2) + * scikit-learn (1.9.0) License: BSD-3-Clause - * langchain (0.3.14) - License: MIT - * langchain-ollama (0.2.2) + * langchain (1.4.0) License: MIT - * langchain-openai (0.2.14) + * langchain-ollama (1.1.0) License: MIT - * langchain-anthropic (0.3.1) + * langchain-openai (1.6.0) License: MIT - * langchain-together (0.2.0) + * langchain-anthropic (1.7.1) License: MIT - * langchain-postgres (0.0.12) + * langchain-together (0.4.0) License: MIT - * langchain-milvus (0.1.7) + * langchain-milvus (0.4.0) License: MIT - * bcrypt (4.2.1) + * bcrypt (5.0.0) License: Apache-2.0 * chevron (0.14.0) License: MIT - * chess (1.11.1) - License: GPL-3.0-or-later - *** SEE WARN *** Operating-system packages installed by the Dockerfile ----------------------------------------------------- * python3-lxml ((Debian bookworm)) - License: BSD-3-Clause (bundles libxml2/libxslt, MIT) - * python3-psycopg2 ((Debian bookworm)) - License: LGPL-3.0-or-later - *** SEE WARN *** + License: BSD-3-Clause * zip ((Debian bookworm)) License: Info-ZIP - * xpdf ((Debian bookworm)) - License: GPL-2.0 OR GPL-3.0 - *** SEE WARN *** Action proxy (copied from the common builder image) --------------------------------------------------- @@ -151,4 +139,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/python/v3.12/WARN b/runtime/python/v3.12/WARN index a72867b..a7e4c97 100644 --- a/runtime/python/v3.12/WARN +++ b/runtime/python/v3.12/WARN @@ -28,34 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : python3-psycopg2 (Debian package) - License : LGPL-3.0-or-later - Category : X - Action : - Installed via apt and shipped inside the image. LGPL is Category X. - REMOVE it from the apt install list, or swap for an Apache-compatible driver. - - Component : xpdf - License : GPL-2.0 OR GPL-3.0 - Category : X - Action : - GPL is Category X and may not be redistributed in an ASF convenience binary. - REMOVE `xpdf` from the apt install list. If PDF text extraction is required, use - an Apache-compatible library such as Apache PDFBox or pypdf (BSD-3-Clause). - - Component : chess (python-chess) - License : GPL-3.0-or-later - Category : X - Action : - GPL-3.0 is Category X. REMOVE `chess` from requirements.txt. It is a sample/demo - dependency and is not required by the runtime itself. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -80,7 +53,7 @@ CATEGORY A ============================================================================== -CATEGORY A (under MIT) +CATEGORY A (UNDER MIT) ============================================================================== Component : simplejson @@ -94,16 +67,16 @@ CATEGORY A (under MIT) SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] python3-psycopg2 (Debian package) -- LGPL-3.0-or-later - [x] xpdf -- GPL-2.0 OR GPL-3.0 - [x] chess (python-chess) -- GPL-3.0-or-later + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: python:3.12.2-bookworm (CPython under the PSF License 2.0). +Base image: python:3.12.14-bookworm (CPython under the PSF License 2.0). +The `chess`, `xpdf` and `python3-psycopg2` components flagged in earlier +revisions of this file are no longer installed by this runtime. The pip dependency tree resolved from requirements.txt is far larger than -the pinned direct requirements listed here. Run `pip-licenses` inside the -built image for the complete transitive inventory before a release audit. - +the direct requirements listed here; requirements.txt records the full +pinned closure. Run `pip-licenses` inside the built image for the +complete inventory before a release audit. diff --git a/runtime/python/v3.13/Dockerfile b/runtime/python/v3.13/Dockerfile index 0932326..f45ccc2 100644 --- a/runtime/python/v3.13/Dockerfile +++ b/runtime/python/v3.13/Dockerfile @@ -68,6 +68,6 @@ RUN chown nobody:root /action && chmod 0775 /action USER nobody # Apache release metadata (see DISCLAIMER, LICENSE, NOTICE, WARN) -COPY DISCLAIMER LICENSE NOTICE / +COPY DISCLAIMER LICENSE NOTICE WARN / ENTRYPOINT ["/bin/proxy"] diff --git a/runtime/python/v3.13/LICENSE b/runtime/python/v3.13/LICENSE index 3f2ffda..956e27c 100644 --- a/runtime/python/v3.13/LICENSE +++ b/runtime/python/v3.13/LICENSE @@ -239,7 +239,7 @@ Apache-2.0 OR BSD-3-Clause python-dateutil (2.8.2) Apache-2.0 OR MIT - uv (latest) + uv ((latest)) BSD-2-Clause feedparser (6.0.11) @@ -256,12 +256,6 @@ BSD-3-Clause starlette (0.46.2) uvicorn (0.34.2) -GPL-2.0 OR GPL-3.0 - xpdf ((Debian bookworm)) - -GPL-3.0-or-later - chess (1.11.1) - GPL-3.0-or-later with GCC Runtime Library Exception build-essential (gcc, binutils) ((Debian bookworm)) @@ -271,11 +265,7 @@ ISC Info-ZIP zip ((Debian bookworm)) -LGPL-3.0-or-later - python3-psycopg2 ((Debian bookworm)) - MIT - auth0-python (4.6.0) beautifulsoup4 (4.13.4) chevron (0.14.0) fastapi (0.115.12) @@ -289,7 +279,6 @@ MIT langchain-milvus (0.1.7) langchain-ollama (0.2.2) langchain-openai (0.2.14) - langchain-postgres (0.0.12) langchain-together (0.2.0) lightgbm (4.5.0) mcp (1.6.0) @@ -316,8 +305,8 @@ mixed; see WARN Detail by component ------------------------------------------------------------------------------ -Python packages preinstalled in the image (requirements.txt) ------------------------------------------------------------- +Python packages preinstalled in the image (requirements.in) +----------------------------------------------------------- beautifulsoup4 (4.13.4) -- MIT ollama (0.4.5) -- MIT openai (1.59.3) -- Apache-2.0 @@ -331,6 +320,7 @@ Python packages preinstalled in the image (requirements.txt) requests (2.32.2) -- Apache-2.0 scrapy (2.5.0) -- BSD-3-Clause simplejson (3.17.5) -- MIT OR AFL-2.1 + Dual-licensed; the MIT option is elected. See WARN. twisted (21.7.0) -- MIT netifaces (0.11.0) -- MIT pyyaml (6.0.2) -- MIT @@ -338,7 +328,6 @@ Python packages preinstalled in the image (requirements.txt) pg8000 (1.31.5) -- BSD-3-Clause pymongo (4.4.1) -- Apache-2.0 minio (7.1.16) -- Apache-2.0 - auth0-python (4.6.0) -- MIT langdetect (1.0.9) -- Apache-2.0 plotly (5.19.0) -- MIT joblib (1.4.2) -- BSD-3-Clause @@ -351,12 +340,9 @@ Python packages preinstalled in the image (requirements.txt) langchain-openai (0.2.14) -- MIT langchain-anthropic (0.3.1) -- MIT langchain-together (0.2.0) -- MIT - langchain-postgres (0.0.12) -- MIT langchain-milvus (0.1.7) -- MIT bcrypt (4.2.1) -- Apache-2.0 chevron (0.14.0) -- MIT - chess (1.11.1) -- GPL-3.0-or-later - *** SEE WARN *** uvicorn (0.34.2) -- BSD-3-Clause fastapi (0.115.12) -- MIT starlette (0.46.2) -- BSD-3-Clause @@ -364,14 +350,10 @@ Python packages preinstalled in the image (requirements.txt) Operating-system packages installed by the Dockerfile ----------------------------------------------------- - python3-psycopg2 ((Debian bookworm)) -- LGPL-3.0-or-later - *** SEE WARN *** zip ((Debian bookworm)) -- Info-ZIP - xpdf ((Debian bookworm)) -- GPL-2.0 OR GPL-3.0 - *** SEE WARN *** ca-certificates ((Debian bookworm)) -- MPL-2.0 Category B: used unmodified. - uv (latest) -- Apache-2.0 OR MIT + uv ((latest)) -- Apache-2.0 OR MIT Installed from astral.sh at build time. build-essential (gcc, binutils) ((Debian bookworm)) -- GPL-3.0-or-later with GCC Runtime Library Exception Build stage only; not present in the final image. @@ -415,4 +397,3 @@ package metadata directories of the respective package manager: * PHP packages: /phpAction/composer/vendor/<pkg>/LICENSE * Go modules: vendored module sources / pkg.go.dev * Debian packages: /usr/share/doc/<pkg>/copyright - diff --git a/runtime/python/v3.13/NOTICE b/runtime/python/v3.13/NOTICE index a2fdbb5..e5e6534 100644 --- a/runtime/python/v3.13/NOTICE +++ b/runtime/python/v3.13/NOTICE @@ -13,8 +13,8 @@ redistributed under the licenses recorded in the LICENSE file that accompanies this NOTICE. Components flagged '*** SEE WARN ***' are listed in the WARN file as incompatible with the Apache License 2.0. -Python packages preinstalled in the image (requirements.txt) ------------------------------------------------------------- +Python packages preinstalled in the image (requirements.in) +----------------------------------------------------------- * beautifulsoup4 (4.13.4) License: MIT * ollama (0.4.5) @@ -41,6 +41,7 @@ Python packages preinstalled in the image (requirements.txt) License: BSD-3-Clause * simplejson (3.17.5) License: MIT OR AFL-2.1 + Dual-licensed; the MIT option is elected. See WARN. * twisted (21.7.0) License: MIT * netifaces (0.11.0) @@ -55,8 +56,6 @@ Python packages preinstalled in the image (requirements.txt) License: Apache-2.0 * minio (7.1.16) License: Apache-2.0 - * auth0-python (4.6.0) - License: MIT * langdetect (1.0.9) License: Apache-2.0 * plotly (5.19.0) @@ -81,17 +80,12 @@ Python packages preinstalled in the image (requirements.txt) License: MIT * langchain-together (0.2.0) License: MIT - * langchain-postgres (0.0.12) - License: MIT * langchain-milvus (0.1.7) License: MIT * bcrypt (4.2.1) License: Apache-2.0 * chevron (0.14.0) License: MIT - * chess (1.11.1) - License: GPL-3.0-or-later - *** SEE WARN *** * uvicorn (0.34.2) License: BSD-3-Clause * fastapi (0.115.12) @@ -103,18 +97,12 @@ Python packages preinstalled in the image (requirements.txt) Operating-system packages installed by the Dockerfile ----------------------------------------------------- - * python3-psycopg2 ((Debian bookworm)) - License: LGPL-3.0-or-later - *** SEE WARN *** * zip ((Debian bookworm)) License: Info-ZIP - * xpdf ((Debian bookworm)) - License: GPL-2.0 OR GPL-3.0 - *** SEE WARN *** * ca-certificates ((Debian bookworm)) License: MPL-2.0 Category B: used unmodified. - * uv (latest) + * uv ((latest)) License: Apache-2.0 OR MIT Installed from astral.sh at build time. * build-essential (gcc, binutils) ((Debian bookworm)) @@ -166,4 +154,3 @@ components and Apache-2.0 licensed libraries listed above. This product includes software developed by third parties under the MIT, BSD, ISC, PSF, MPL-2.0 and other licenses, as recorded in LICENSE. - diff --git a/runtime/python/v3.13/WARN b/runtime/python/v3.13/WARN index 94166d7..6089dea 100644 --- a/runtime/python/v3.13/WARN +++ b/runtime/python/v3.13/WARN @@ -28,34 +28,7 @@ Category X components that this Dockerfile ADDS on purpose must be removed. ============================================================================== -CATEGORY X -============================================================================== - - Component : python3-psycopg2 (Debian package) - License : LGPL-3.0-or-later - Category : X - Action : - Installed via apt and shipped inside the image. LGPL is Category X. - REMOVE it from the apt install list, or swap for an Apache-compatible driver. - - Component : xpdf - License : GPL-2.0 OR GPL-3.0 - Category : X - Action : - GPL is Category X and may not be redistributed in an ASF convenience binary. - REMOVE `xpdf` from the apt install list. If PDF text extraction is required, use - an Apache-compatible library such as Apache PDFBox or pypdf (BSD-3-Clause). - - Component : chess (python-chess) - License : GPL-3.0-or-later - Category : X - Action : - GPL-3.0 is Category X. REMOVE `chess` from requirements.txt. It is a sample/demo - dependency and is not required by the runtime itself. - - -============================================================================== -CATEGORY X (as bundled) +CATEGORY X (AS BUNDLED) ============================================================================== Component : Debian/Ubuntu/Alpine base image userland @@ -69,7 +42,18 @@ CATEGORY X (as bundled) ============================================================================== -CATEGORY X (build only) +CATEGORY A +============================================================================== + + Component : zip / unzip (Info-ZIP) + License : Info-ZIP License + Category : A + Action : + BSD-like and Apache-compatible. No action required. + + +============================================================================== +CATEGORY X (BUILD ONLY) ============================================================================== Component : build-essential / gcc @@ -93,18 +77,7 @@ CATEGORY B ============================================================================== -CATEGORY A -============================================================================== - - Component : zip / unzip (Info-ZIP) - License : Info-ZIP License - Category : A - Action : - BSD-like and Apache-compatible. No action required. - - -============================================================================== -CATEGORY A (under MIT) +CATEGORY A (UNDER MIT) ============================================================================== Component : simplejson @@ -118,16 +91,16 @@ CATEGORY A (under MIT) SUMMARY OF REQUIRED REMOVALS (Category X added by this Dockerfile) ============================================================================== - [x] python3-psycopg2 (Debian package) -- LGPL-3.0-or-later - [x] xpdf -- GPL-2.0 OR GPL-3.0 - [x] chess (python-chess) -- GPL-3.0-or-later + None. This Dockerfile adds no Category X component. ============================================================================== ADDITIONAL NOTES ============================================================================== -Base image: python:3.13.4-slim-bookworm (CPython under the PSF License 2.0). +Base image: python:3.13.15-slim-bookworm (build) / python:3.13.4-slim-bookworm (final) (CPython under the PSF License 2.0). +The `chess`, `xpdf` and `python3-psycopg2` components flagged in earlier +revisions of this file are no longer installed by this runtime. The pip dependency tree resolved from requirements.txt is far larger than -the pinned direct requirements listed here. Run `pip-licenses` inside the -built image for the complete transitive inventory before a release audit. - +the direct requirements listed here; requirements.txt records the full +pinned closure. Run `pip-licenses` inside the built image for the +complete inventory before a release audit.
