Third-party notices & SBOM¶
Who this is for: anyone redistributing DataQ's images, and the reviewer who has to confirm what a release bundles and under which licences. DataQ itself is MIT; every dependency it ships is permissive or weak-copyleft, and the notices and bill of materials below are generated from the real dependency set on every build, never hand-maintained.
What ships, and where¶
| Artifact | Where to find it | What it covers |
|---|---|---|
THIRD-PARTY-NOTICES.md |
/THIRD-PARTY-NOTICES.md in the backend image |
every Python package installed into the image's virtualenv — name, version, licence, homepage, the full licence text and any Apache NOTICE file shipped with the package |
THIRD-PARTY-NOTICES.md |
/THIRD-PARTY-NOTICES.md in the frontend image, also served at https://<your-dataq>/third-party-notices |
every runtime npm package bundled into the web app (build-only tooling is not distributed and is not listed) |
THIRD-PARTY-NOTICES-backend.md, THIRD-PARTY-NOTICES-frontend.md |
assets on each GitHub release | the same two files, extracted from the images that release published |
sbom-dataq-backend.spdx.json, sbom-dataq-frontend.spdx.json |
assets on each GitHub release (and a workflow artifact of every image build) | an SPDX 2.3 SBOM produced by Syft over the published image: the Python / npm packages and the base image's OS packages, with licence data where the package declares it |
The base images' own packages (Debian for the backend, Alpine for the frontend) are
covered by the SBOM, not by the notices file; their licence texts live under
/usr/share/doc and /usr/share/licenses in the image as the distributions ship them.
Verify¶
# Read the notices straight out of a published image.
docker run --rm --entrypoint cat ghcr.io/theurgicduke771/dataq-backend:latest /THIRD-PARTY-NOTICES.md | less
docker run --rm --entrypoint cat ghcr.io/theurgicduke771/dataq-frontend:latest /THIRD-PARTY-NOTICES.md | less
# From a running deployment.
curl -fsS https://<your-dataq>/third-party-notices | head
# Re-derive the SBOM yourself and compare package lists with the release asset.
syft ghcr.io/theurgicduke771/dataq-backend:v1.3.0 -o spdx-json > local.spdx.json
The licence gate¶
Continuous integration fails a change whose dependency tree — the backend's full runtime + test requirements, and the frontend's whole lockfile — adds a package under a strong-copyleft or source-available licence (GPL, AGPL, SSPL, BUSL, Elastic, Commons Clause), or whose licence cannot be determined from its metadata. Permissive licences (MIT, BSD, Apache-2.0, ISC, PSF, Unlicense, 0BSD, Zlib, CC0, BlueOak, OFL for bundled fonts) and weak copyleft with notice preservation (MPL-2.0, LGPL) are allowed; a dual-licensed package passes when one of its options is allowed. The backend image build runs the same check over the exact set it installs, so a violation cannot reach a published image either way.
A package whose packaging metadata omits or misstates a licence that is known and
permissive is admitted only through a reviewed override in the repository
(scripts/licenses/overrides.toml), which records the SPDX licence, a link to the
upstream licence file as evidence, and the reason. The override cannot admit a forbidden
licence; that would need an architecture-decision-level exception.