Skip to content

Licenses

The project is licensed under Apache-2.0 with DCO (ADR 0003). Shipped parts (server, images, apps, SDKs, adapters) may only contain dependencies with a compatible license. Development tools under tools/ are not shipped; the list does not apply to them (their licenses are listed in toolchain.md).

Allowed licenses

The source of truth is quality/licenses/allowed.txt; a test keeps this table equal to it.

SPDX Kind
0BSD permissive
Apache-2.0 permissive, with patent license
BSD-2-Clause permissive
BSD-3-Clause permissive
BSL-1.0 permissive
CC0-1.0 public-domain-like
ISC permissive
MIT permissive
MIT-0 permissive
MPL-2.0 weak copyleft per file; use only unmodified
PSF-2.0 permissive
Python-2.0 permissive
Unicode-3.0 permissive (Unicode data)
Unicode-DFS-2016 permissive (Unicode data)
Zlib permissive

Not allowed without an ADR: GPL, AGPL, LGPL in statically linked parts (Go server, apps), SSPL, BUSL, licenses with usage restrictions (for example Commons Clause), proprietary and unknown licenses. A service under such a license may be connected as a separate process if the chapter of the service justifies it (for example the virus scanner in chapter 12).

MPL-2.0 is allowed because its obligations only affect modified files of the library; the planning basis names River (MPL-2.0) for background jobs.

License gate (make licenses)

  1. LICENSE is the unmodified Apache-2.0 text (sha256 against https://www.apache.org/licenses/LICENSE-2.0.txt, retrieved 2026-10-10) [verified].
  2. Every handwritten source file carries SPDX-License-Identifier: Apache-2.0 in the first license.spdx_header_lines lines; generated code is exempt (tools/ci/license_check.py). A Go file that counts as generated by its name (*.gen.go, *_gen.go, *.pb.go) or by a directory named generated above it carries the marker // Code generated ... DO NOT EDIT. before the package line; otherwise it is a finding, so that a hand-written file does not drop out of the SPDX check, coverage and Sonar by its name alone.
  3. Dependencies of shipped components: OSV-Scanner with --licenses and the list above over all lock files of the component (Go, Dart, Python, npm); OSV-Scanner obtains license data via deps.dev (https://github.com/google/osv-scanner, retrieved 2026-10-10) [verified]. The step judges only license violations of the JSON report (tools/ci/dep_licenses.py); the vulnerabilities the same scan reports are the business of make osv (docs/DECISIONS.md PL/32). For Go, additionally go-licenses check over the packages actually linked. If OSV-Scanner reports a license as UNKNOWN or non-standard (deps.dev does not know the license text as an SPDX expression), the license is checked in the LICENSE file of the package and recorded with a reason in an osv-scanner.toml of the component as PackageOverrides; never as a blanket rule for all packages. The Grafana panel plugin (M7-25) ships only its own code: React, Emotion and @grafana/* are webpack externals that Grafana provides, and the rest of its lock are build and test tools. Its osv-scanner.toml therefore also lists, per package version and with a reason, packages under a license outside the list that are such tools or reached only through those externals (license.ignore); a unit test of the plugin fails when another production dependency enters (docs/DECISIONS.md D-M7-25-5).
  4. Before every release and before going public: ScanCode over the whole tree (license texts and copyright notices in files), result in the release record. ScanCode is not a pull request gate, because a run over the whole tree takes a long time. As built (M7-10): make scancode scans the tracked tree (git archive HEAD) with ScanCode Toolkit 32.5.0 in a container built from tools/scancode/Dockerfile (base image pinned by digest, release archive by sha256; linux/amd64 only, emulated on arm64 hosts), writes scancode.json and runs tools/ci/scancode_policy.py: every file whose detected license expression the list above does not satisfy (OR needs one allowed side, AND both, WITH its license; LicenseRef-* never) and every file ScanCode could not scan is a finding, except paths listed with a reason in quality/licenses/scancode-exceptions.txt (text that names or quotes a license without licensing the file). In release.yml the job scancode runs it for every server tag; a finding stops the release before any image tag, and the report is attached to the release.

Bundled fonts

The apps bundle the fonts Atkinson Hyperlegible Next and Atkinson Hyperlegible Mono as asset files under packages/design_system/fonts/ (docs/design/typography.md). Their license is OFL-1.1, settled by D-L11 and docs/design/typography.md (reason 5): the OFL allows embedding in apps and redistribution when the license text ships with the files. The font files are bundled assets, not package dependencies: make licenses (OSV-Scanner over the lock files) does not see them, and quality/licenses/allowed.txt stays unchanged. Instead the OFL text of each family lies next to the files (fonts/<family>.OFL.txt), fonts/MANIFEST.json records "license": "OFL-1.1" per file, and packages/design_system/test/fonts_test.dart fails when a font file has no license text, a manifest entry names another license, or a file differs from its recorded SHA-256. NOTICE names both fonts with their copyright (docs/DECISIONS.md D-M4-04-4).

Bundled native code

The apps load SQLite3MultipleCiphers as their encrypted SQLite (docs/spec/15-client-architecture.md 6, packages/local_store). The build hook of the Dart package sqlite3 (3.7.1, MIT, a lock file package that make licenses checks) downloads the prebuilt library of its release and verifies it against the sha256 hashes in its sources; the root pubspec.yaml selects it with hooks: user_defines: sqlite3: source: sqlite3mc. SQLite3MultipleCiphers 2.6.1 is under the MIT license (LICENSE of its repository, Ulrich Telle); the SQLite 3.54.0 it contains is in the public domain (https://sqlite.org/copyright.html). Both are bundled native code, not packages of the lock file: OSV-Scanner does not see them and quality/licenses/allowed.txt stays unchanged; MIT is on that list (docs/DECISIONS.md D-M4-12-9).

SBOM and checking releases

  • Every release contains sbom.spdx.json (SPDX, generated with Syft via anchore/sbom-action) and SHA256SUMS. Server releases (M7-10) instead carry SPDX and CycloneDX SBOMs per image platform and per binary from the pinned Syft, signature bundles and a signed SHA256SUMS (18-release.md 6.1).
  • Server images carry provenance and SBOM as an attestation in the registry entry (Buildx, provenance: mode=max, sbom: true).
  • In addition, signed build provenance and SBOM attestation via GitHub Artifact Attestations, as long as the repository is public (ADR 0039); check with gh attestation verify <file> --repo <owner>/<repo> (https://github.com/actions/attest-build-provenance, retrieved 2026-10-10) [verified].