Third-party software in the container images

The OGuardAI container images bundle three kinds of third-party software: operating-system packages from the base image and the packages we add, the Python distributions the detector needs, and the NER model weights the detector bakes. This page is for an operator who has to know what is inside an image and what it is licensed under before deploying it.

Model weights are covered separately, because they are pluggable and carry their own licences. See Model licences. This page covers the operating-system and packaged software layer.

Every published image ships a signed inventory

Each published image carries an SPDX software bill of materials (SBOM) that lists every component Syft can catalog: the operating-system packages, the Python distributions, and their versions and licences. The SBOM is attached to the image as a cosign attestation, so it is signed and pinned to the exact image digest. The same SBOM that ships to you is the one our pipeline evaluated for licences before the image was published, so the inventory you can verify is the inventory we gated.

You can read it yourself:

# Verify and print the SBOM attestation for a pinned digest.
cosign verify-attestation \
  --type spdxjson \
  --certificate-identity-regexp '.*' \
  --certificate-oidc-issuer-regexp '.*' \
  ghcr.io/oronts/oguardai/server@sha256:<digest>

The licence gate

Before an image is published, its SBOM is evaluated against an operating-system aggregation licence policy. A container image aggregates independently licensed programs onto one filesystem. Aggregating separate works on a shared medium does not combine them into a single work, so licences that are a concern when code is statically linked into one binary are acceptable at the image layer, while network copyleft, non-commercial, and proprietary licences are not.

• Accepted as aggregation: the permissive licences (MIT, Apache-2.0, BSD, ISC and similar), and the GPL, LGPL, MPL, EPL, OpenSSL, and Unicode families.
• Never accepted: AGPL, SSPL, the Business Source License, the Commons Clause, the non-commercial and no-derivatives Creative Commons variants, and end-user-licence or proprietary terms.

A component whose licence is not on the accepted set fails the gate, so the policy is fail-closed: an unknown licence blocks publication rather than slipping through. The gate also confirms the operating-system packages come from the Debian main archive and that the notice-bearing packages we add, such as the OCR engine and its trained-data packs, are present and inventoried.

Notices travel with the image

The images carry the licence and notice files at /app/LICENSE, /app/NOTICE, and, for the detector image, /app/THIRD-PARTY-MODELS.md. Debian packages keep their copyright files under /usr/share/doc/<package>/copyright. Together these satisfy the notice-retention obligations of the bundled software when you redistribute an image.

Source availability for GPL and LGPL packages

PLACEHOLDER, pending legal review. Some accepted operating-system packages are under the GPL or LGPL, which carry an obligation to make corresponding source available. The exact wording of the written offer to provide that source, and the channel through which it is fulfilled, is being prepared with counsel and will be published here. Do not treat this paragraph as the binding offer.

The model layer is separate

The NER model weights are not operating-system software and are pluggable. Their licences, which default routes are permissive or attribution class, which require explicit acceptance, and how to substitute a model you hold rights to, are documented in Model licences and in THIRD-PARTY-MODELS.md in the repository.