Skip to content

THIRD_PARTY_NOTICES.md

Latest commit

 

History

History
69 lines (48 loc) · 3.9 KB

THIRD_PARTY_NOTICES.md

File metadata and controls

69 lines (48 loc) · 3.9 KB
Raw

Third-Party Notices

PawFlow Docker images bundle third-party operating system packages, language runtimes, package-manager dependencies, and developer tools. This file summarizes the redistribution posture for the public images built by .github/workflows/docker-publish.yml.

This notice is not a substitute for dependency review. The release workflow does not publish BuildKit SBOM/provenance attestations because GHCR exposes those attestation manifests as extra untagged package versions.

Public Images

PawFlow publishes these redistributable images:

  • ghcr.io/allcolor/pawflow
  • ghcr.io/allcolor/pawflow-relay-minimal
  • ghcr.io/allcolor/pawflow-relay-dev

The full relay image intentionally uses Playwright-managed Chromium instead of Google Chrome and does not install Microsoft Visual Studio Code desktop. code-server is used for browser-based editor support.

Image Not Published

PawFlow does not publish pawflow-claude-code:latest. That image is built locally because it installs Claude Code and Antigravity binaries whose redistribution terms are not suitable for a public PawFlow image.

License Families Present

The public images may include software under, among others:

  • MIT
  • Apache-2.0
  • BSD-style licenses
  • Python Software Foundation License
  • LGPL-family licenses for selected libraries
  • GPL-family licenses for selected Ubuntu/Debian packages and command-line tools
  • Ubuntu/Debian package copyright and trademark notices

The project source code is licensed separately under the repository license. Third-party packages retain their own licenses and notices.

Vendored Frontend Libraries

  • tasks/io/chat_ui/vendor/livekit-client.umd.min.js — livekit-client 2.20.1, Apache-2.0. Served to browsers at /api/realtime/livekit/sdk.js for realtime LiveKit sessions. Update by downloading the pinned UMD build from npm/jsdelivr and recording the new version here.
  • tasks/io/chat_ui/three.module.min.js — three.js r170 (npm three@0.170.0), MIT. Served to browsers at /chat/js/three.module.min.js and lazily imported by the webchat Openspace 3D view (openspace.js). Stored flat (not under vendor/) because the /chat/js/{path} route matches a single path segment. Update by downloading the pinned ESM build from jsdelivr and recording the new version here.

Bundled Command-Line Tools

  • docker-buildx — Docker Buildx 0.36.1, Apache-2.0. The PawFlow server image copies the pinned, architecture-matched CLI plugin from the official docker/buildx-bin image so installer-driven local builds use BuildKit.
  • search — paperfoot/search-cli 0.9.0, MIT. The PawFlow server image builds the Linux binary from pinned commit 3ebd955e51035c53c7f8bf3c5b62be652ff441ff with Cargo's locked dependency graph and without the unsupported Linux stealth feature.

Physical Relay Seccomp Profile

  • pawflow_relay/physical-seccomp.json derives from the default profile in moby/profiles, pinned at 61eaf32614c7c71b60bd8927d3e6a4ffc8ff1f31, Apache-2.0. PawFlow adds only a pivot_root allow rule conditional on CAP_SYS_ADMIN. The upstream license is included as pawflow_relay/physical-seccomp.LICENSE.

Release Checklist

Before making a Docker release public:

  1. Confirm the workflow builds only the three public images listed above.
  2. Confirm no public image installs Google Chrome, Microsoft Visual Studio Code desktop, Claude Code, or Antigravity.
  3. Review image dependency changes for unexpected proprietary packages.
  4. Keep this notice and the repository license reachable from the package source URL.
  5. If a new binary installer or package repository is added, verify its redistribution terms before publishing the image.