Third-Party Software & Licenses

Third-Party Software & Licenses#

The container images published by this project bundle several open-source and proprietary software components. This document lists the major components, their versions, and their licenses.

The project’s own code is licensed under MIT — see the LICENSE file, the SPDX-License-Identifier: MIT header on every source file, and the org.opencontainers.image.licenses="MIT" label on the published images. Each upstream component below carries its own license terms.

Maintaining this list#

Everything between the generated:deps-table markers is generated. Editing it by hand is lost on the next sync_versions.py --write; the two sections after the end marker are hand-written. The sources are:

File	Holds
`deps/deps.json`	every component: name, licence, URL, and which image it is in
`../linux/scripts/01-core/versions.env`	the version, so the list can never disagree with the build

Regenerate after any change:

python3 docs/scripts/sync_versions.py --write     # this page + the website pages
python3 docs/scripts/generate_sbom.py --write     # docs/deps/sbom-curated.spdx.json

Adding a component#

Add one object to the right subsections[].entries[] array in deps.json:

{
  "name": "libfoo",                       // shown in the table
  "var": "LIBFOO_VERSION",                // key in versions.env -- preferred
  // "version_fixed": "Ubuntu apt",       // ...only when there is no pin
  "url": "https://github.com/example/libfoo",
  "license": "LGPLv2.1+",                 // free text, for humans
  "spdx": "LGPL-2.1-or-later"             // REQUIRED -- machine-readable
}

spdx is not optional. A licence name cannot be turned into an obligation; an SPDX id can. If the id is new, add it to scripts/license_obligations.py with what it requires, or the gate fails with the id it could not map.

If it is copyleft, it also needs a source pointer#

GPL, LGPL, MPL and AGPL require the corresponding source to accompany the binary. The gate refuses a copyleft component without one:

"source": {
  "kind": "upstream-tag",
  "url": "https://git.example.org/libfoo.git",
  "ref_var": "LIBFOO_VERSION",            // resolved from versions.env, so it cannot drift
  // "ref": "default branch",             // ...when there is no pin
  "build_flags": "--enable-gpl",          // ONLY when flags decide the licence
  "patches": ["path/to/0001-fix.patch"],  // if this repo patches it
  "note": "Anything a reader needs to know."
}

build_flags matters more than it looks: FFmpeg is LGPL by default and becomes GPLv3 because this project builds it --enable-gpl --enable-version3. The flags are the reason for the obligation, so they are recorded next to it.

If this repo patches it#

Add "modified" as well. Apache-2.0 §4(b) and the GPL family both require stating that a redistributed component was changed:

"modified": {
  "patches": ["windows/scripts/patches/gstreamer/001-ges-commit-rename.patch"],
  "note": "The Windows build patches a GES symbol rename."
}

What the gate checks#

preflight.sh slugs version-snapshot and sbom run in CI (linux-x64.yml; sbom.yml re-checks the curated SBOM weekly) and in make preflight. The pre-commit hook runs neither. Together they fail when:

an entry has no spdx;
an spdx id has no obligation mapping;
a copyleft component has no source block;
the rendered pages or the curated SBOM have drifted from deps.json;
the webserver Dockerfile stops overlaying the generated page onto the path the site actually requests.

Run them yourself before committing:

PREFLIGHT_ONLY=version-snapshot,sbom bash linux/scripts/preflight.sh

What this list is NOT#

It is the curated half: components this project chooses and builds. It does not enumerate transitive dependencies — the apt closure, cargo crates, Python wheels. Those come from an image scan; see sbom.md for how the two halves fit together and why neither is sufficient alone.

Linux Images (`ghcr.io/kataglyphis/kataglyphis_beschleuniger`)#

Base Layer (`Dockerfile.base`)#

Software	Version	Repository	License
Ubuntu	26.04	ubuntu.com	GPLv2 / various (individual packages)
CMake	4.4.4	cmake.org	BSD 3-Clause
Node.js	26.11.1	nodejs.org	MIT
uv	0.13.1	github.com/astral-sh/uv	Apache 2.0 / MIT
Vulkan SDK	1.4.363.0	vulkan.lunarg.com	Apache 2.0

Compiler Toolchain (`Dockerfile.toolchain`)#

Software	Version	Repository	License
GCC (host + cross)	16.2.0	gcc.gnu.org	GPLv3+ with GCC Runtime Library Exception
LLVM / Clang	23.1.3	llvm.org	Apache 2.0 with LLVM Exceptions
Python	3.15.0	python.org	PSF License
Rust toolchain	latest stable	rust-lang.org	MIT / Apache 2.0

SDK Layer (`Dockerfile.sdk`)#

Software	Version	Repository	License
Apache TVM	v0.27.0	tvm.apache.org	Apache 2.0

Media Layer (`Dockerfile.media`)#

Software	Version	Repository	License
ONNX Runtime	v1.31.0	github.com/microsoft/onnxruntime	MIT
ONNX Runtime GenAI	v0.17.0	github.com/microsoft/onnxruntime-genai	MIT
LiteRT (TensorFlow Lite)	v2.3.0	www.tensorflow.org/lite	Apache 2.0
OpenCV	5.0.0	opencv.org	Apache 2.0
GStreamer	1.29.2	gstreamer.freedesktop.org	LGPLv2+
GStreamer Rust plugins (gst-plugins-rs)	1.29.2	gitlab.freedesktop.org/gstreamer/gst-plugins-rs	MPL-2.0
librice / rice-proto (webrtcbin2)	v0.4.3	github.com/ystreet/librice	Apache 2.0
FFmpeg	n9.0.2	ffmpeg.org	GPLv3+ (built with –enable-gpl –enable-version3)
FFmpeg codec libraries (x264, x265, libvpx, aom, dav1d, SVT-AV1, opus, LAME, vorbis, libass, twolame)	Ubuntu apt	ffmpeg.org/legal.html	GPL / LGPL / various
VVdeC (VVC/H.266 decoder)	v3.2.1	github.com/fraunhoferhhi/vvdec	BSD-3-Clause-Clear
ArmNN (arm64)	v26.07	github.com/ARM-software/armnn	MIT
Arm Compute Library (arm64)	v53.3.1	github.com/ARM-software/ComputeLibrary	MIT
libcamera	v0.7.2	libcamera.org	LGPLv2.1+
Abseil	20260817.0	github.com/abseil/abseil-cpp	Apache 2.0
FreeType	2.15.0	freetype.org	GPLv2 / FTL
nv-codec-headers	n13.1.15.0	git.videolan.org/git/ffmpeg/nv-codec-headers.git	MIT
GObject-Introspection	1.86.0	gitlab.gnome.org/GNOME/gobject-introspection	LGPLv2+
IREE	v3.12.0	iree.dev	Apache 2.0 with LLVM Exception
PyAV	19.0.1	github.com/PyAV-Org/PyAV	BSD 3-Clause

Android Layer (`Dockerfile.android`)#

Software	Version	Repository	License
Android SDK	15859902	developer.android.com/studio	Apache 2.0 / Google ToS
Android NDK	29.0.14206865	developer.android.com/ndk	Apache 2.0
Android Build Tools	36.0.0	developer.android.com/studio/releases/build-tools	Apache 2.0
Android CMake	4.1.2	cmake.org	BSD 3-Clause
Android builds of LiteRT / ONNX Runtime / OpenCV / GStreamer	same versions as Media Layer	developer.android.com/ndk	Apache 2.0 / MIT / LGPLv2+ (per component)

Optional GPU — NVIDIA (`Dockerfile.nvidia`)#

Software	Version	Repository	License
CUDA Toolkit	13.4.3	developer.nvidia.com/cuda-toolkit	NVIDIA EULA
cuDNN	9.27.0.42	developer.nvidia.com/cudnn	NVIDIA cuDNN EULA
TensorRT	11.4.0.106	developer.nvidia.com/tensorrt	NVIDIA TensorRT EULA

Optional — NVIDIA DeepStream (nvidia variant, ENABLE_DEEPSTREAM=true only) (`Dockerfile.media`)#

Software	Version	Repository	License
DeepStream runtime (NVIDIA’s prebuilt deepstream-binaries-x86 .deb: nvvideoconvert, nvv4l2decoder, the tiler, libnvbufsurface and the nvds libraries)	9.1.0	github.com/NVIDIA/DeepStream/releases/tag/v9.1.0	NVIDIA SDK License Agreement + DeepStream supplement (LicenseAgreement.pdf, shipped in the tree)
DeepStream sources (gst-plugins, gst-utils, utils; built against /opt/gstreamer)	9.1.0	github.com/NVIDIA/DeepStream	Apache 2.0
TensorRT 10 (DeepStream’s private copy beside TENSORRT_VERSION)	10.16.1.11	developer.nvidia.com/tensorrt	NVIDIA TensorRT EULA
civetweb (nvds_rest_server)	v1.16	github.com/civetweb/civetweb	MIT
prometheus-cpp (nvds_rest_server)	v1.2.4	github.com/jupp0r/prometheus-cpp	MIT
opentelemetry-cpp (nvds_rest_server)	v1.23.0	github.com/open-telemetry/opentelemetry-cpp	Apache 2.0

Optional GPU — AMD (`Dockerfile.amd`)#

Software	Version	Repository	License
ROCm	10.1	rocm.docs.amd.com	Apache 2.0 / MIT (varies by component)
MIGraphX	2.18.0	github.com/ROCm/AMDMIGraphX	MIT

Optional Accelerator — Hailo (`Dockerfile.torch`)#

Software	Version	Repository	License
HailoRT (libhailort, hailortcli)	5.4.0	github.com/hailo-ai/hailort	MIT
HailoRT hailonet GStreamer element	5.4.0	github.com/hailo-ai/hailort	LGPLv2.1+
protobuf (HailoRT build external)	21.12	github.com/protocolbuffers/protobuf	BSD-3-Clause
TAPPAS	5.4.0	github.com/hailo-ai/tappas	LGPL-2.1-or-later
libzmq (TAPPAS zmq elements)	4.3.5	github.com/zeromq/libzmq	MPL-2.0
TAPPAS build externals (header-only: xtensor, xtl, cxxopts, pybind11, rapidjson, Catch2)	commit-pinned in build-hailort.sh	github.com/hailo-ai/tappas	BSD-3-Clause / MIT / BSL-1.0 (per project)
cppzmq (TAPPAS zmq elements)	4.11.0	github.com/zeromq/cppzmq	MIT

Frameworks (`Dockerfile.torch`)#

Software	Version	Repository	License
PyTorch	v2.14.1	pytorch.org	BSD-3-Clause
TorchVision	v0.29.1	github.com/pytorch/vision	BSD-3-Clause
Flutter SDK	3.47.7	flutter.dev	BSD 3-Clause

Test runtimes (`Dockerfile.package`)#

Software	Version	Repository	License
Chrome for Testing (amd64, arm64)	155.0.8059.79	googlechromelabs.github.io/chrome-for-testing	Google Chrome Terms of Service (the zip’s ABOUT names chrome://terms); Chromium’s notices at chrome://credits
chromedriver (amd64, arm64)	155.0.8059.79	googlechromelabs.github.io/chrome-for-testing	BSD 3-Clause (LICENSE.chromedriver and THIRD_PARTY_NOTICES.chromedriver in the zip)
Android Emulator (amd64)	37.2.12	developer.android.com/studio/run/emulator	Android SDK License; Apache 2.0 (LICENSE), a QEMU derivative (GPLv2), per-component NOTICE.csv
Android 15 (API 35) system image, Google APIs x86_64 (amd64)	9	developer.android.com/studio/run/managing-avds	Android SDK License; AOSP components under their own licences (NOTICE.txt in the image), the kernel GPLv2

Runtime (`Dockerfile.torch`)#

Software	Version	Repository	License
OrchestrANT	develop	github.com/Kataglyphis/OrchestrANT	MIT

LLM Stack (`llm-stack/Dockerfile`)#

Software	Version	Repository	License
Ollama	0.40.4	github.com/ollama/ollama	MIT

Build Tooling (build-time only, not in runtime images)#

Software	Version	Repository	License
Emscripten / emsdk (ONNX Runtime WASM build)	pinned by ONNX Runtime	emscripten.org	MIT / NCSA
ccache	Ubuntu apt	ccache.dev	GPLv3+
sccache	Ubuntu apt	github.com/mozilla/sccache	Apache 2.0
Meson	latest (PyPI)	mesonbuild.com	Apache 2.0
Ninja	latest (PyPI)	ninja-build.org	Apache 2.0
cargo-c (C-ABI build of gst-plugins-rs)	latest (crates.io)	github.com/lu-zero/cargo-c	MIT / Apache 2.0
cerbero (GStreamer Android build system)	git default branch	gitlab.freedesktop.org/gstreamer/cerbero	LGPLv2.1+

Webserver Image (`ghcr.io/kataglyphis/kataglyphis_beschleuniger:webserver`)#

Packages#

Software	Version	Repository	License
Ubuntu	26.04	ubuntu.com	GPLv2 / various
nginx	latest (apt)	nginx.org	BSD 2-Clause

Windows Image (`ghcr.io/kataglyphis/kataglyphis_beschleuniger:winamd64`)#

Base Toolchain#

Software	Version	Repository	License
Windows Server Core	2025	www.microsoft.com	Microsoft EULA
Visual Studio Build Tools	18	visualstudio.microsoft.com	Microsoft EULA
Python (source-built, ClangCL)	3.15.0	python.org	PSF License
CPython bundled externals (OpenSSL, SQLite, libffi, xz, bzip2, zlib, tcl/tk, expat, mpdecimal)	bundled with Python	github.com/python/cpython-source-deps	various (Apache 2.0, MIT, PD, …)
CMake	4.4.4	cmake.org	BSD 3-Clause
Vulkan SDK	1.4.363.0	vulkan.lunarg.com	Apache 2.0
Rust toolchain	latest stable	rust-lang.org	MIT / Apache 2.0
WiX Toolset	latest	wixtoolset.org	MS-RL
Flutter SDK	3.47.7	flutter.dev	BSD 3-Clause

GPU Layer#

Software	Version	Repository	License
CUDA	13.4.3	developer.nvidia.com/cuda-toolkit	NVIDIA EULA
cuDNN	9.27.0.42	developer.nvidia.com/cudnn	NVIDIA cuDNN EULA
TensorRT	11.4.0.106	developer.nvidia.com/tensorrt	NVIDIA TensorRT EULA
AMD ROCm for Windows (TheRock tarball, C:\TheRock\build; rocm variant only)	10.1.0	github.com/ROCm/TheRock	per component: MIT (rocBLAS, hipBLASLt, MIOpen, rocFFT, rocRAND, rocSPARSE, hipcc, …), BSD (rocSOLVER, hipCUB), Apache-2.0 (rocThrust, LLVM WITH LLVM-exception); the notices in share\doc ship with the tree. The HIP and OpenCL runtime DLLs carry no licence file and link AMD’s prebuilt PAL: redistribution in a PUBLIC image is an owner decision
Khronos Vulkan loader (LunarG VulkanRT Components: vulkan-1.dll in System32 on the rocm variant; the pinned copy and its licence in C:\vulkan-loader, on PATH in the default and nvidia images; the arm64 bundle’s copy and licence in C:\runtime\lavapipe)	1.4.363.0	vulkan.lunarg.com	Apache 2.0 (Khronos Vulkan-Loader) with MIT components (cJSON, Dave Gamble; joseph werle); VulkanRT-License.txt ships in C:\vulkan-loader
Mesa lavapipe (the CPU Vulkan ICD: lvp_icd.x86_64/aarch64.json + vulkan_lvp.dll in C:\runtime\lavapipe; mmozeiko/build-mesa, SHA256-pinned)	26.2.4	github.com/mmozeiko/build-mesa	MIT (Mesa 3D; the 7z carries no licence text, so this release repository and mesa3d.org are the pointer)
PyTorch + TorchVision for ROCm (built from upstream source against TheRock’s ROCm 10.1.0 SDK, kernels for gfx1201 and gfx1200, on AMD’s rocm[libraries] runtime; rocm variant only)	torch 2.14.1+rocm10.1.0 and torchvision 0.29.1+rocm10.1.0 from the v2.14.1 / v0.29.1 tags (commits pinned as TORCH_ROCM_WINDOWS_COMMIT), with AMD’s rocm-sdk runtime and device wheels for gfx1201 and gfx1200 (URL + SHA256 pinned as TORCH_ROCM_WINDOWS)	github.com/pytorch/pytorch	BSD 3-Clause (PyTorch, TorchVision); the bundled ROCm runtime as above (MIT/BSD/Apache-2.0 plus the HIP runtime without a licence file)
LiteRT Python (ai-edge-litert wheel: libLiteRt.dll, libLiteRtWebGpuAccelerator.dll and the pywrap* extensions, in the torch app venv on every amd64 variant: built from source for PYTHON_VERSION, CON91)	LITERT_VERSION from source for PYTHON_VERSION’s cpXY (CON91); its libLiteRtWebGpuAccelerator.dll from the 2.3.0 PyPI wheel, pinned as LITERT_WINDOWS_WEBGPU_ACCELERATOR_SHA256	github.com/google-ai-edge/LiteRT	Apache 2.0 (the wheel’s METADATA, and since 2.3.0 LiteRT’s LICENSE in its dist-info; no NOTICE text). libLiteRtWebGpuAccelerator.dll is a closed Google binary: LiteRT’s Apache-2.0 wrapper around ML Drift, which LiteRT’s WORKSPACE declares with no public URL; it imports only system DLLs, so Dawn/Tint (BSD 3-Clause) are linked in statically

Media Layer#

Software	Version	Repository	License
GStreamer	1.29.2	gstreamer.freedesktop.org	LGPLv2+
GStreamer meson subprojects (glib, orc, libnice, x264, openh264, …)	per wrap files	gstreamer.freedesktop.org	LGPLv2+ / GPL (x264) / BSD (openh264)
GStreamer Rust plugins rswebrtc and rsrtp (gst-plugins-rs net/webrtc, net/rtp)	1.29.2	gitlab.freedesktop.org/gstreamer/gst-plugins-rs	MPL-2.0
Rust crates linked into gstrswebrtc.dll and gstrsrtp.dll (gstreamer-rs, gtk-rs-core, tokio, rustls, ring, …)	pinned by gst-plugins-rs’s Cargo.lock at the GStreamer tag	gitlab.freedesktop.org/gstreamer/gst-plugins-rs	MIT / Apache 2.0 / ISC / BSD / Unicode-3.0 / CDLA-Permissive-2.0 (per crate, 337 crates on 2026-10-05)
ONNX Runtime	v1.31.0	github.com/microsoft/onnxruntime	MIT
ONNX Runtime GenAI	v0.17.0	github.com/microsoft/onnxruntime-genai	MIT
OpenCV	5.0.0	opencv.org	Apache 2.0
FFmpeg	n9.0.2	ffmpeg.org	GPLv3+ (built with –enable-gpl –enable-version3)
LiteRT (TensorFlow Lite)	v2.3.0	www.tensorflow.org/lite	Apache 2.0
LiteRT-LM	0.18.0	github.com/google-ai-edge/LiteRT-LM	Apache 2.0
Apache TVM	v0.27.0	tvm.apache.org	Apache 2.0
AMD AMF SDK headers (FFmpeg –enable-amf; rocm variant only)	v1.5.3	github.com/GPUOpen-LibrariesAndSDKs/AMF	MIT
Vulkan SDK headers + glslc (FFmpeg –enable-vulkan; rocm variant only)	1.4.363.0	vulkan.lunarg.com	Apache-2.0 OR MIT (Vulkan-Headers; no election recorded, so both are listed) and MIT (SPIRV-Headers); glslc is build-time only

LiteRT-LM GPU Backend (rocm variant only)#

Software	Version	Repository	License
LiteRT-LM WebGPU accelerator + TopK sampler (prebuilt libLiteRtWebGpuAccelerator.dll, libLiteRtTopKWebGpuSampler.dll)	0.18.0	github.com/google-ai-edge/LiteRT-LM	Apache 2.0 (the LiteRT-LM repository’s licence; closed-source Google binaries, no source published) + BSD 3-Clause (statically linked protobuf)
Dawn WebGPU (prebuilt webgpu_dawn.dll)	as prebuilt in LiteRT-LM (sha256-pinned)	dawn.googlesource.com/dawn	BSD 3-Clause (Dawn/Tint) + Apache 2.0 (statically linked abseil, SPIRV-Tools)
DirectX Shader Compiler (dxcompiler.dll, dxil.dll)	per LiteRT-LM WORKSPACE (sha256-pinned)	github.com/microsoft/DirectXShaderCompiler	NCSA (LLVM; the package’s ReleaseNotes apply it to every file but d3d12shader.h, which is MIT and not shipped) + Microsoft Software License Terms (LICENSE-MS.txt is in the zip without naming the files it covers, so it is read as applying until reviewed); all three texts ship in C:\runtime\lib\litert-lm\licenses

ONNX Runtime WebGPU EP (rocm variant only)#

Software	Version	Repository	License
Dawn WebGPU + Tint (statically linked into the chain onnxruntime.dll and onnxruntime_pybind11_state.pyd: C:\runtime\lib\onnxruntime-source and every chain onnxruntime wheel)	v20260916.214021	github.com/google/dawn	BSD 3-Clause (Dawn/Tint; the text ships in the wheel’s onnxruntime\ThirdPartyNotices.txt as ORT’s own ‘dawn’ entry) + Apache 2.0 (SPIRV-Tools: Dawn configures it, and the header-only SPIRV-Headers, whenever DAWN_USE_BUILT_DXC is ON; listed until a link map shows the D3D12-only, SPIR-V-off build leaves it out). jinja2 and markupsafe (BSD 3-Clause) run at build time only, as Dawn’s code generator, and are not shipped
DirectX Shader Compiler for the ORT WebGPU EP (dxcompiler.dll beside the chain onnxruntime.dll and in onnxruntime\capi of every chain wheel)	v1.9.2609	github.com/microsoft/DirectXShaderCompiler	NCSA (LLVM) + Microsoft Software License Terms (LICENSE-MS.txt, read as applying until reviewed, as for the LiteRT-LM copy); all three texts ship in C:\runtime\lib\onnxruntime-source\licenses\directx-shader-compiler and are appended to the wheel’s onnxruntime\ThirdPartyNotices.txt

llama.cpp HIP and Vulkan (rocm variant only)#

Software	Version	Repository	License
llama.cpp HIP (ggml-hip.dll built from the pinned tag’s source against TheRock, linking the image’s HIP runtime; llama-server.exe and the other tools from the same tag’s official Windows CPU zip)	11617	github.com/ggml-org/llama.cpp	MIT; the zip carries no llama.cpp licence text, so LICENSE is fetched at the pinned tag (sha256-pinned) and ships in C:\runtime\opt\llama.cpp-hip\licenses\llama.cpp
llama.cpp (official prebuilt Windows Vulkan release of the same build: ggml-vulkan.dll, llama-server.exe and the other tools)	11617	github.com/ggml-org/llama.cpp	MIT; the zip carries no llama.cpp licence text, so the same tag’s LICENSE (sha256-pinned) ships in C:\runtime\opt\llama.cpp-vulkan\licenses\llama.cpp
LLVM OpenMP runtime (libomp.dll, bundled in both llama.cpp zips: CPU and Vulkan)	as bundled in the pinned llama.cpp zips (sha256-pinned; the two copies are byte-identical)	github.com/llvm/llvm-project/tree/main/openmp	Apache 2.0 with LLVM Exceptions (older code also under the legacy NCSA/MIT terms); LICENSE-LLVM-OpenMP ships beside each copy, in C:\runtime\opt\llama.cpp-hip and C:\runtime\opt\llama.cpp-vulkan

MIGraphX + ORT plugin EP (rocm variant only)#

Software	Version	Repository	License
AMD MIGraphX (source-built against TheRock, C:\runtime\lib\migraphx)	2.18.0	github.com/ROCm/AMDMIGraphX	MIT; the texts of everything linked into it ship in C:\runtime\lib\migraphx\licenses
abseil-cpp (static, in MIGraphX through protobuf)	20250512.0	github.com/abseil/abseil-cpp	Apache 2.0
Protocol Buffers + utf8_range (static, in migraphx_onnx.dll)	30.0	github.com/protocolbuffers/protobuf	BSD 3-Clause + MIT (the bundled utf8_range)
msgpack-c (header-only, in migraphx.dll)	3.3.0	github.com/msgpack/msgpack-c	Boost 1.0 (its bundled Boost Predef/Preprocessor too)
SQLite amalgamation (static, in migraphx.dll)	3500400	www.sqlite.org	Public domain (the SQLite blessing; no text to ship)
nlohmann/json (header-only, in migraphx.dll; TheRock’s copy)	as shipped in TheRock	github.com/nlohmann/json	MIT (TheRock ships no licence file for it, so the header’s own copyright + SPDX notice is staged instead)
ONNX Runtime plugin EP for AMD GPUs (migraphx-ep.dll, C:\runtime\lib\onnxruntime-ep-amdgpu)	99ab5cb43caa421e0b19870fa4ce9323117e5e56	github.com/onnxruntime/onnxruntime-ep-amdgpu	MIT; the texts of everything linked into it ship in C:\runtime\lib\onnxruntime-ep-amdgpu\licenses
fmt (static, in migraphx-ep.dll)	12.1.0	github.com/fmtlib/fmt	MIT
Microsoft GSL (header-only, in migraphx-ep.dll)	4.2.1	github.com/microsoft/GSL	MIT
range-v3 (header-only, in migraphx-ep.dll)	0.12.0	github.com/ericniebler/range-v3	Boost 1.0 (its LICENSE.txt also carries the libc++ and SGI/HP notices of adapted code)
ONNX (static, in migraphx-ep.dll)	1.21.0	github.com/onnx/onnx	Apache 2.0
FlatBuffers (static, in migraphx-ep.dll)	25.12.19	github.com/google/flatbuffers	Apache 2.0
Protocol Buffers + utf8_range (static, in migraphx-ep.dll)	34.1	github.com/protocolbuffers/protobuf	BSD 3-Clause + MIT (the bundled utf8_range)
abseil-cpp (static, in migraphx-ep.dll through protobuf)	20250512.1	github.com/abseil/abseil-cpp	Apache 2.0

Build Tooling (build-time only)#

Software	Version	Repository	License
Scoop package manager	latest	scoop.sh	Unlicense / MIT
Scoop-installed tools (7-Zip, Git, LLVM, ninja, NASM, OpenSSL, NSIS, cppcheck, nano, uv, NuGet)	latest (scoop)	scoop.sh	various (GPL, Apache 2.0, BSD, zlib)
sccache (Windows lane)	0.18.0	github.com/mozilla/sccache	Apache 2.0
vcpkg	master	github.com/microsoft/vcpkg	MIT
vcpkg packages (zlib, protobuf — linked into builds)	vcpkg baseline	github.com/microsoft/vcpkg	Zlib / BSD 3-Clause

Documentation Image (`pandoc_all`)#

Document Toolchain (`third_party/DocumANTation/Dockerfile`)#

Software	Version	Repository	License
Ubuntu	26.04	ubuntu.com	GPLv2 / various (individual packages)
Pandoc	3.12.1	github.com/jgm/pandoc	GPLv2+
TeX Live (texlive-full)	Ubuntu apt	tug.org/texlive	Collection; per package LPPL / GPL / X11 / modified BSD
Latin Modern fonts (lmodern)	Ubuntu apt	www.gust.org.pl/projects/e-foundry/latin-modern	GUST Font License (LPPL-style)
Ghostscript	Ubuntu apt	www.ghostscript.com	AGPLv3+
ImageMagick	Ubuntu apt	imagemagick.org	ImageMagick License (Apache 2.0-style)

Python (`third_party/DocumANTation/Dockerfile`)#

Software	Version	Repository	License
Python	Ubuntu apt (python3-full)	python.org	PSF License
uv	0.13.1	github.com/astral-sh/uv	Apache 2.0 / MIT
Pygments	pinned by uv.lock	pygments.org	BSD 2-Clause

Base Utilities (`third_party/DocumANTation/Dockerfile`)#

Software	Version	Repository	License
GNU C Library locales (locales)	Ubuntu apt	www.gnu.org/software/libc	LGPLv2.1+
curl	Ubuntu apt	curl.se	curl (MIT/X-style)
GNU Wget	Ubuntu apt	www.gnu.org/software/wget	GPLv3+
ca-certificates	Ubuntu apt	packages.ubuntu.com/ca-certificates	MPL-2.0 (CA bundle) / GPLv2+ (packaging)
less	Ubuntu apt	www.greenwoodsoftware.com/less	GPLv3+ or Less License
sudo	Ubuntu apt	www.sudo.ws	ISC (with BSD-2/3-Clause parts)

Vendored LaTeX Themes (`third_party/DocumANTation/Dockerfile`)#

Software	Version	Repository	License
awesome-beamer (fork of LukasPietzschmann/awesome-beamer)	git submodule	github.com/Kataglyphis/awesome-beamer	BSD 3-Clause
smile (fork of LukasPietzschmann/smile)	git submodule	github.com/Kataglyphis/smile	BSD 3-Clause

Host Build Infrastructure (runs on the build host, not inside any image)#

Container Engines & Builders#

Software	Version	Repository	License
nerdctl (Linux builds & container runs)	host install	github.com/containerd/nerdctl	Apache 2.0
containerd	host install	containerd.io	Apache 2.0
BuildKit (buildkitd)	host install	github.com/moby/buildkit	Apache 2.0
Stevedore (Windows builds — bundled docker.exe)	host install	github.com/slonopotamus/stevedore	Apache 2.0
GenieX (on-device LLM/VLM runtime for Snapdragon; WSL2 client + Windows host server)	host install (GenieX CLI v0.6.1)	github.com/qualcomm/GenieX	BSD 3-Clause

What these licences require#

Every obligation below is triggered by at least one component actually shipped in an image on this page. This is a structured reading of the licence texts, not legal advice.

keep-notice — Reproduce the upstream copyright notice with the distributed binary.
include-text — Ship the full licence text alongside the binary.
state-changes — Mark modified files as changed, and say what was changed.
notice-file — Propagate the upstream NOTICE file if one exists.
offer-source — Provide the complete corresponding source, or a written offer valid for three years. Publishing the binary without either is the obligation most often missed.
allow-relink — Let the recipient replace the library and relink. Shipping it as a shared object, as this project does, satisfies the mechanism; the notice and text are still required.
network-source — AGPL section 13: users interacting with the software OVER A NETWORK must be offered its source. This reaches further than the GPL and is worth checking against how the component is actually exposed.
same-licence — Derivative works of this component must carry the same licence.
eula-review — Proprietary terms. Redistribution is NOT automatically granted – the vendor EULA decides whether this component may ship in a published image at all. This is a legal question, not a documentation one.

Corresponding source#

The components below are copyleft-licensed, so their source must accompany the binaries. Each entry names the exact upstream and the revision this project builds, any patches applied on top, and — where the build configuration is what determines the licence — the flags used.

If a link ever fails to resolve, the obligation stands: request the corresponding source and it will be provided.

Ubuntu — Linux Images#

Licence: LicenseRef-Distro-Bundle
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

GCC (host + cross) — Linux Images#

Licence: GPL-3.0-or-later WITH GCC-exception-3.1
Source: https://ftp.gnu.org/gnu/gcc/
Revision: 16.2.0
Built unmodified from the GNU release tarball. The Runtime Library Exception covers programs COMPILED with GCC; it does not cover shipping GCC itself, which the runtime image does.

GStreamer — Linux Images#

Licence: LGPL-2.0-or-later
Source: https://gitlab.freedesktop.org/gstreamer/gstreamer
Revision: 1.29.2

GStreamer Rust plugins (gst-plugins-rs) — Linux Images#

Licence: MPL-2.0
Source: https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs
Revision: 1.29.2

FFmpeg — Linux Images#

Licence: GPL-3.0-or-later
Source: https://git.ffmpeg.org/ffmpeg.git
Revision: n9.0.2
Build configuration: --enable-gpl --enable-version3 --enable-libx264 --enable-libx265
Those flags are what make the shipped binary GPLv3, rather than FFmpeg’s default LGPL.

FFmpeg codec libraries (x264, x265, libvpx, aom, dav1d, SVT-AV1, opus, LAME, vorbis, libass, twolame) — Linux Images#

Licence: GPL-2.0-or-later AND LGPL-2.1-or-later
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

libcamera — Linux Images#

Licence: LGPL-2.1-or-later
Source: https://git.libcamera.org/libcamera/libcamera.git
Revision: v0.7.2

FreeType — Linux Images#

Licence: GPL-2.0-or-later OR FTL
Source: https://download.savannah.gnu.org/releases/freetype/
Revision: 2.15.0
Dual-licensed. This project elects the FTL, which needs only notice and text; the source pointer is provided anyway.

GObject-Introspection — Linux Images#

Licence: LGPL-2.0-or-later
Source: https://gitlab.gnome.org/GNOME/gobject-introspection
Revision: 1.86.0

Android builds of LiteRT / ONNX Runtime / OpenCV / GStreamer — Linux Images#

Licence: Apache-2.0 AND MIT AND LGPL-2.0-or-later
Source: https://gitlab.freedesktop.org/gstreamer/gstreamer
Revision: same refs as the Media Layer rows above

HailoRT hailonet GStreamer element — Linux Images#

Licence: LGPL-2.1-or-later
Source: hailo-ai/hailort
Revision: 5.4.0

TAPPAS — Linux Images#

Licence: LGPL-2.1-or-later
Source: hailo-ai/tappas
Revision: 5.4.0

libzmq (TAPPAS zmq elements) — Linux Images#

Licence: MPL-2.0
Source: zeromq/libzmq
Revision: 4.3.5

Android Emulator (amd64) — Linux Images#

Licence: Apache-2.0 AND GPL-2.0-only AND LicenseRef-Proprietary-EULA
Source: https://android.googlesource.com/platform/external/qemu
Revision: emu-master-dev
NOTICE.csv in the emulator directory names the source of every bundled component.

Android 15 (API 35) system image, Google APIs x86_64 (amd64) — Linux Images#

Licence: Apache-2.0 AND GPL-2.0-only AND LicenseRef-Proprietary-EULA
Source: https://android.googlesource.com/platform/manifest
Revision: android15-release
NOTICE.txt beside system.img maps each file to its licence; the goldfish kernel is in android.googlesource.com/kernel/common.

ccache — Linux Images#

Licence: GPL-3.0-or-later
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

cerbero (GStreamer Android build system) — Linux Images#

Licence: LGPL-2.1-or-later
Source: https://gitlab.freedesktop.org/gstreamer/cerbero
Revision: default branch
Build-time only; never shipped in a runtime image.

Ubuntu — Webserver Image#

Licence: LicenseRef-Distro-Bundle
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

CPython bundled externals (OpenSSL, SQLite, libffi, xz, bzip2, zlib, tcl/tk, expat, mpdecimal) — Windows Image#

Licence: LicenseRef-Distro-Bundle
Source: python/cpython-source-deps
Revision: as bundled by the pinned CPython
Redistributed unmodified as part of the CPython build.

GStreamer — Windows Image#

Licence: LGPL-2.0-or-later
Source: https://gitlab.freedesktop.org/gstreamer/gstreamer
Revision: 1.29.2
Patches applied: windows/scripts/patches/gstreamer/001-ges-commit-rename.patch

GStreamer meson subprojects (glib, orc, libnice, x264, openh264, …) — Windows Image#

Licence: LGPL-2.0-or-later AND GPL-2.0-or-later AND BSD-2-Clause
Source: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/tree/main/subprojects
Revision: pinned by the GStreamer release’s wrap files
x264 is GPL, so its presence is what makes this subproject set copyleft.

GStreamer Rust plugins rswebrtc and rsrtp (gst-plugins-rs net/webrtc, net/rtp) — Windows Image#

Licence: MPL-2.0
Source: https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs
Revision: 1.29.2
Built unmodified from the gstreamer- tag (GitHub mirror) by Build-GstreamerFromSource.ps1 phase 8b, with upstream’s Cargo.lock (–locked).

FFmpeg — Windows Image#

Licence: GPL-3.0-or-later
Source: https://git.ffmpeg.org/ffmpeg.git
Revision: n9.0.2
Build configuration: --enable-gpl --enable-version3 --enable-libx264 --enable-libx265
Patches applied: windows/scripts/patches/ffmpeg/001-allow-msys-builds.patch
Those flags are what make the shipped binary GPLv3, rather than FFmpeg’s default LGPL.

Scoop-installed tools (7-Zip, Git, LLVM, ninja, NASM, OpenSSL, NSIS, cppcheck, nano, uv, NuGet) — Windows Image#

Licence: LicenseRef-Distro-Bundle
Source: https://scoop.sh/
Revision: —
Build-time tooling installed from upstream publishers; each carries its own source location. sccache is the exception – see its own row, it is installed from the official release zip.

Ubuntu — Documentation Image#

Licence: LicenseRef-Distro-Bundle
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

Pandoc — Documentation Image#

Licence: GPL-2.0-or-later
Source: jgm/pandoc
Revision: 3.12.1

TeX Live (texlive-full) — Documentation Image#

Licence: LicenseRef-Distro-Bundle
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

Ghostscript — Documentation Image#

Licence: AGPL-3.0-or-later
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive. AGPL section 13 also reaches network-exposed use – check how this component is exposed.

GNU C Library locales (locales) — Documentation Image#

Licence: LGPL-2.1-or-later
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

GNU Wget — Documentation Image#

Licence: GPL-3.0-or-later
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

ca-certificates — Documentation Image#

Licence: MPL-2.0 AND GPL-2.0-or-later
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

less — Documentation Image#

Licence: GPL-3.0-or-later
Source: https://archive.ubuntu.com/ubuntu/
Revision: —
Unmodified Ubuntu binary package. Source: apt-get source <pkg> on the matching release, or the Ubuntu source archive.

Modified components#

This project patches the following upstreams before redistributing them. Both the Apache-2.0 and the GPL families require that modification be stated.

GStreamer — Windows Image — The Windows build patches a GES symbol rename, and carries upstream GStreamer commit 17d22abe89 in gst-plugins-bad’s ext/dtls/gstdtlsconnection.c (an empty BIO read signals retry, not EOF) until GSTREAMER_VERSION moves past 1.29.2. Patches: windows/scripts/patches/gstreamer/001-ges-commit-rename.patch.
FFmpeg — Windows Image — The Windows build patches configure to allow MSYS2 builds. Patches: windows/scripts/patches/ffmpeg/001-allow-msys-builds.patch.

Each patch is in this repository at the path shown, and travels with the corresponding source above.

License Summary by Category#

Category	Common Licenses
Compilers & toolchains	GPLv3+, Apache 2.0, MIT, BSD
Media libraries	LGPLv2+, Apache 2.0, MIT
GPU toolkits	NVIDIA EULA, Apache 2.0, MIT
Android SDK/NDK	Apache 2.0, Google ToS
Runtime languages	MIT, PSF, Apache 2.0
Windows platform	Microsoft EULA
Build tools	BSD, MIT, Apache 2.0

Notes#

Ubuntu system packages carry diverse licenses (GPL, LGPL, Apache 2.0, MIT, BSD, zlib, Public Domain). Check /usr/share/doc/<pkg>/copyright inside the image for exact terms.
NVIDIA EULAs require acceptance before download/use. The build fetches CUDA/cuDNN from NVIDIA, and TensorRT is staged by hand. The published :winamd64 image does carry all three (its config on 2026-09-25: CUDA 13.4, cuDNN 9.26.0.51, TensorRT 11.3.0.99), so whether that redistribution is permitted is the eula-review question above, not a settled one. No published Linux image carries them: :latest-nvidia is not published yet.
“git master” versions are built from the latest development branch at the time the image was built. For exact commit SHAs, inspect the build logs.
Version numbers marked with are automatically kept in sync with linux/scripts/01-core/versions.env by sync_versions.py.