# Third-Party Licenses

DevCage bundles and distributes third-party open-source software within its
Docker image and desktop UI application. DevCage itself does not modify, link
against, or create derivative works of any of these components — they are
installed unmodified from their official distribution channels (Ubuntu apt
repositories, npm, pip, GitHub releases, Homebrew, crates.io). This constitutes
"mere aggregation" under the GPL and similar licenses.

DevCage's own scripts (launchers, entrypoint, installers) are licensed under the
DevCage License — see [LICENSE](LICENSE). The third-party components listed below
retain their original licenses.

---

## Base Image

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| Ubuntu 25.10 (Plucky Puffin) | Various (see [Ubuntu IP Policy](https://ubuntu.com/legal/intellectual-property-policy)) | © Canonical Ltd. | https://hub.docker.com/_/ubuntu |

---

## System Packages — Permissive Licenses

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| curl | MIT/X | © Daniel Stenberg et al. | https://curl.se/ |
| python3 | PSF-2.0 | © Python Software Foundation | https://www.python.org/ |
| pip | MIT | © Python Packaging Authority | https://pip.pypa.io/ |
| jq | MIT | © Stephen Dolan | https://jqlang.github.io/jq/ |
| ripgrep (rg) | MIT / Unlicense | © Andrew Gallant | https://github.com/BurntSushi/ripgrep |
| httpie | BSD-3-Clause | © Jakub Roztočil | https://httpie.io/ |
| libssl-dev (OpenSSL) | Apache-2.0 | © The OpenSSL Project | https://www.openssl.org/ |
| zlib1g-dev | zlib License | © Jean-loup Gailly, Mark Adler | https://zlib.net/ |
| libsqlite3-dev | Public Domain | © D. Richard Hipp | https://sqlite.org/ |
| libffi-dev | MIT | © Anthony Green et al. | https://sourceware.org/libffi/ |
| libncurses-dev | MIT/X11 | © Free Software Foundation | https://invisible-island.net/ncurses/ |
| libbz2-dev | BSD-style | © Julian Seward | https://sourceware.org/bzip2/ |
| fzf | MIT | © Junegunn Choi | https://github.com/junegunn/fzf |
| fd-find | MIT / Apache-2.0 | © David Peter | https://github.com/sharkdp/fd |
| bat | MIT / Apache-2.0 | © David Peter | https://github.com/sharkdp/bat |
| micro | MIT | © Zachary Yedidia | https://micro-editor.github.io/ |
| tmux | ISC | © Nicholas Marriott | https://github.com/tmux/tmux |
| git-lfs | MIT | © GitHub, Inc. | https://git-lfs.com/ |
| watchman | MIT | © Meta Platforms, Inc. | https://facebook.github.io/watchman/ |
| postgresql-client | PostgreSQL License | © The PostgreSQL Global Development Group | https://www.postgresql.org/ |
| neovim | Apache-2.0 | © Neovim contributors | https://neovim.io/ |
| vim | Vim License | © Bram Moolenaar et al. | https://www.vim.org/ |
| unzip / zip | Info-ZIP License | © Info-ZIP | https://infozip.sourceforge.net/ |
| docker-ce-cli | Apache-2.0 | © Docker, Inc. | https://www.docker.com/ |
| docker-buildx-plugin | Apache-2.0 | © Docker, Inc. | https://github.com/docker/buildx |
| docker-compose-plugin | Apache-2.0 | © Docker, Inc. | https://github.com/docker/compose |
| gh (GitHub CLI) | MIT | © GitHub, Inc. | https://cli.github.com/ |
| clang-format | Apache-2.0 with LLVM Exception | © LLVM Project | https://clang.llvm.org/ |
| clang-tidy | Apache-2.0 with LLVM Exception | © LLVM Project | https://clang.llvm.org/ |
| wrk | Apache-2.0 | © Will Glozer | https://github.com/wg/wrk |
| cron (Vixie cron) | ISC | © Paul Vixie, Internet Systems Consortium | https://github.com/vixie/cron |
| python3-setuptools | MIT | © Python Packaging Authority | https://github.com/pypa/setuptools |

---

## System Packages — Copyleft Licenses (GPL/LGPL)

These packages are installed unmodified from Ubuntu's official apt repositories.
DevCage does not modify, patch, or create derivative works of any of them.
Source code is available via `apt-get source <package>` inside the container.

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| git | GPL-2.0-only | © Linus Torvalds, Junio C Hamano et al. | https://git-scm.com/ |
| wget | GPL-3.0-or-later | © Free Software Foundation | https://www.gnu.org/software/wget/ |
| tar | GPL-3.0-or-later | © Free Software Foundation | https://www.gnu.org/software/tar/ |
| make | GPL-3.0-or-later | © Free Software Foundation | https://www.gnu.org/software/make/ |
| gcc / g++ | GPL-3.0-or-later with GCC Runtime Library Exception | © Free Software Foundation | https://gcc.gnu.org/ |
| dpkg-dev | GPL-2.0-or-later | © Debian Project | https://wiki.debian.org/Teams/Dpkg |
| libreadline-dev | GPL-3.0-or-later | © Free Software Foundation | https://tiswww.case.edu/php/chet/readline/rltop.html |
| gnupg | GPL-3.0-or-later | © Free Software Foundation | https://gnupg.org/ |
| nano | GPL-3.0-or-later | © Free Software Foundation | https://www.nano-editor.org/ |
| emacs-nox | GPL-3.0-or-later | © Free Software Foundation | https://www.gnu.org/software/emacs/ |
| shellcheck | GPL-3.0-or-later | © Vidar Holen | https://www.shellcheck.net/ |
| htop | GPL-2.0-or-later | © Hisham Muhammad | https://htop.dev/ |
| pandoc | GPL-2.0-or-later | © John MacFarlane | https://pandoc.org/ |
| tree | GPL-2.0-or-later | © Steve Baker | https://mama.indstate.edu/users/ice/tree/ |
| iproute2 | GPL-2.0-or-later | © Alexey Kuznetsov et al. | https://wiki.linuxfoundation.org/networking/iproute2 |
| iptables | GPL-2.0-only | © Netfilter Project | https://www.netfilter.org/ |
| gdb | GPL-3.0-or-later | © Free Software Foundation | https://www.sourceware.org/gdb/ |
| valgrind | GPL-2.0-or-later | © Valgrind Developers | https://valgrind.org/ |
| pkg-config | GPL-2.0-or-later | © Freedesktop.org | https://www.freedesktop.org/wiki/Software/pkg-config/ |
| autoconf | GPL-3.0-or-later | © Free Software Foundation | https://www.gnu.org/software/autoconf/ |
| automake | GPL-2.0-or-later | © Free Software Foundation | https://www.gnu.org/software/automake/ |
| libtool | GPL-2.0-or-later | © Free Software Foundation | https://www.gnu.org/software/libtool/ |
| cppcheck | GPL-3.0-or-later | © Daniel Marjamäki et al. | https://cppcheck.sourceforge.io/ |
| bear | GPL-3.0-or-later | © László Nagy | https://github.com/rizsotto/Bear |
| doxygen | GPL-2.0-only | © Dimitri van Heesch | https://www.doxygen.nl/ |
| ca-certificates | GPL-2.0-or-later / MPL-2.0 | © Mozilla, SPI Inc. | https://packages.debian.org/ca-certificates |
| strace | LGPL-2.1-or-later | © Dmitry Levin et al. | https://strace.io/ |
| glibc / libc-dev | LGPL-2.1-or-later | © Free Software Foundation | https://www.gnu.org/software/libc/ |
| xz-utils | Public Domain / GPL-2.0-or-later | © Lasse Collin et al. | https://tukaani.org/xz/ |
| util-linux (setpriv) | GPL-2.0-or-later | © Karel Zak et al. | https://github.com/util-linux/util-linux |

---

## Language Runtimes

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| Eclipse Temurin JDK | GPL-2.0-only with Classpath Exception | © Eclipse Adoptium, Oracle et al. | https://adoptium.net/ |
| Apache Maven | Apache-2.0 | © The Apache Software Foundation | https://maven.apache.org/ |
| Gradle | Apache-2.0 | © Gradle, Inc. | https://gradle.org/ |
| Node.js | MIT | © OpenJS Foundation, Node.js contributors | https://nodejs.org/ |
| Corepack | MIT | © Node.js contributors | https://github.com/nodejs/corepack |
| Go | BSD-3-Clause | © The Go Authors (Google) | https://go.dev/ |
| Rust / rustup / Cargo | MIT / Apache-2.0 | © The Rust Project Developers | https://www.rust-lang.org/ |
| .NET SDK | MIT | © .NET Foundation, Microsoft | https://dotnet.microsoft.com/ |
| PHP | PHP-3.01 | © The PHP Group | https://www.php.net/ |
| Composer | MIT | © Nils Adermann, Jordi Boggiano | https://getcomposer.org/ |
| SDKMAN! | Apache-2.0 | © Marco Vermeulen | https://sdkman.io/ |

---

## Binary Tools (installed from GitHub releases)

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| CMake | BSD-3-Clause | © Kitware, Inc. | https://cmake.org/ |
| Ninja | Apache-2.0 | © Evan Martin et al. | https://ninja-build.org/ |
| ccache | GPL-3.0-or-later | © ccache contributors | https://ccache.dev/ |
| yq | MIT | © Mike Farah | https://github.com/mikefarah/yq |
| delta | MIT | © Dan Davison | https://github.com/dandavison/delta |
| mkcert | BSD-3-Clause | © Filippo Valsorda | https://github.com/FiloSottile/mkcert |
| direnv | MIT | © Jonas Pfenniger Chevalier | https://direnv.net/ |
| just | CC0-1.0 | © Casey Rodarmor | https://github.com/casey/just |
| websocat | MIT | © Vitaly Shukela | https://github.com/vi/websocat |
| shfmt | BSD-3-Clause | © Daniel Martí | https://github.com/mvdan/sh |
| shellharden | MPL-2.0 | © Andreas Nordal | https://github.com/anordal/shellharden |
| Mailpit | MIT | © Ralph Slooten | https://mailpit.axllent.org/ |
| Delve (dlv) | MIT | © Derek Parker et al. | https://github.com/go-delve/delve |
| Air | MIT | © cosmtrek | https://github.com/air-verse/air |

---

## Homebrew Packages

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| Homebrew (Linuxbrew) | BSD-2-Clause | © Homebrew contributors | https://brew.sh/ |
| Trivy | Apache-2.0 | © Aqua Security | https://trivy.dev/ |
| Semgrep (CLI) | LGPL-2.1 | © Semgrep, Inc. | https://semgrep.dev/ |

> **Note on Semgrep**: The Semgrep CLI is LGPL-2.1. Semgrep Rules (the rulesets
> used by `--config auto`) are licensed separately under the
> [Semgrep Rules License v1.0](https://semgrep.dev/legal/rules-license), which
> permits free use for security scanning but has restrictions on building
> competing products.

---

## Auto-installed Security Tools

The following tools are **not** pre-installed in the DevCage image. They are
automatically downloaded on first use by the `audit` command.

| Tool | License | Copyright | Source |
|------|---------|-----------|--------|
| hadolint | GPL-3.0-or-later | © Lukas Martinelli et al. | https://github.com/hadolint/hadolint |
| OWASP Dependency-Check | Apache-2.0 | © Jeremy Long | https://owasp.org/www-project-dependency-check/ |
| govulncheck | BSD-3-Clause | © The Go Authors | https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck |
| cargo-audit | Apache-2.0 / MIT | © RustSec Advisory Database | https://github.com/rustsec/rustsec |
| SpotBugs | LGPL-2.1-or-later | © SpotBugs team | https://spotbugs.github.io/ |
| PMD | BSD-2-Clause / Apache-2.0 | © PMD Contributors | https://pmd.github.io/ |
| Checkstyle | LGPL-2.1-or-later | © Checkstyle contributors | https://checkstyle.org/ |

---

## Python Packages (pip)

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| pre-commit | MIT | © Anthony Sottile | https://pre-commit.com/ |
| ruff | MIT | © Astral Software Inc. | https://docs.astral.sh/ruff/ |
| pytest | MIT | © Holger Krekel et al. | https://pytest.org/ |
| mypy | MIT | © Jukka Lehtosalo et al. | https://mypy-lang.org/ |
| ipython | BSD-3-Clause | © IPython Development Team | https://ipython.org/ |
| bashate | Apache-2.0 | © OpenStack Foundation | https://github.com/openstack/bashate |

---

## Node.js Packages (npm)

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| playwright | Apache-2.0 | © Microsoft Corporation | https://playwright.dev/ |
| @playwright/mcp | Apache-2.0 | © Microsoft Corporation | https://github.com/anthropics/anthropic-tools |
| lighthouse | Apache-2.0 | © Google LLC | https://github.com/GoogleChrome/lighthouse |
| @biomejs/biome | MIT / Apache-2.0 | © Biome Developers | https://biomejs.dev/ |
| typescript | Apache-2.0 | © Microsoft Corporation | https://www.typescriptlang.org/ |
| tsx | MIT | © Hiroki Osame | https://github.com/privatenumber/tsx |
| serve | MIT | © Vercel, Inc. | https://github.com/vercel/serve |
| @dotenvx/dotenvx | BSD-3-Clause | © dotenvx | https://dotenvx.com/ |
| nodemon | MIT | © Remy Sharp | https://nodemon.io/ |
| concurrently | MIT | © Kimmo Brunfeldt | https://github.com/open-cli-tools/concurrently |

---

## Chromium Browser

Chromium is installed via Playwright (`npx playwright install chromium`) and is
used for headless browser automation, screenshots, and Lighthouse auditing.

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| Chromium | BSD-3-Clause (base) + various sub-licenses | © The Chromium Authors (Google) | https://www.chromium.org/ |

Chromium includes components under various licenses. See the full listing at:
https://source.chromium.org/chromium/chromium/src/+/main:LICENSE

---

## Docker-in-Docker Sidecar

The DinD sidecar image is pulled at runtime and is not bundled in the DevCage
image itself.

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| docker:dind | Apache-2.0 | © Docker, Inc. | https://hub.docker.com/_/docker |

---

## AI CLI Tools (NOT bundled)

The following AI CLI tools are **not** pre-installed in the DevCage image. They
are lazily downloaded and installed on first use by wrapper scripts. Each tool is
third-party software subject to its own license and terms of service. Use
requires your own API key and acceptance of the respective provider's terms.

| Tool | License | Provider | Terms of Service |
|------|---------|----------|------------------|
| Claude Code | Proprietary | Anthropic, PBC | https://www.anthropic.com/legal/terms |
| Gemini CLI | Apache-2.0 | Google LLC | https://ai.google.dev/gemini-api/terms |
| Codex CLI | Apache-2.0 | OpenAI, Inc. | https://openai.com/policies/terms-of-use |
| Aider | Apache-2.0 | Paul Gauthier | https://aider.chat/ |
| GitHub Copilot CLI | Proprietary | GitHub, Inc. | https://github.com/features/copilot/cli |
| Goose | Apache-2.0 | Block, Inc. | https://github.com/block/goose |

DevCage is not affiliated with, endorsed by, or sponsored by any of these
providers.

---

## Desktop UI Application (devcage-ui)

The DevCage desktop application is built with Tauri. The following dependencies
are compiled into the distributed binary (Rust crates) or bundled into the
frontend (npm packages). Build-only dev dependencies (`@tauri-apps/cli`,
`svelte-check`, `@sveltejs/vite-plugin-svelte`, `typescript`) are not included
in the distributed binary and are omitted.

### Rust Crates

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| Tauri | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/tauri |
| tauri-build | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/tauri |
| tauri-plugin-dialog | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/plugins-workspace |
| tauri-plugin-shell | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/plugins-workspace |
| tauri-plugin-fs | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/plugins-workspace |
| serde | MIT / Apache-2.0 | © David Tolnay et al. | https://serde.rs/ |
| serde_json | MIT / Apache-2.0 | © David Tolnay et al. | https://github.com/serde-rs/json |
| dirs | MIT / Apache-2.0 | © dirs-rs contributors | https://github.com/dirs-dev/dirs-rs |

### npm Packages

| Component | License | Copyright | Source |
|-----------|---------|-----------|--------|
| @tauri-apps/api | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/tauri |
| @tauri-apps/plugin-dialog | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/plugins-workspace |
| @tauri-apps/plugin-shell | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/plugins-workspace |
| @tauri-apps/plugin-fs | MIT / Apache-2.0 | © Tauri Contributors | https://github.com/tauri-apps/plugins-workspace |
| Svelte | MIT | © Rich Harris et al. | https://svelte.dev/ |
| Vite | MIT | © Evan You et al. | https://vitejs.dev/ |

---

## Source Availability for GPL/Copyleft Components

All GPL-licensed and other copyleft-licensed components listed above are
installed unmodified from their official distribution channels:

- **Ubuntu apt packages**: Source available via `apt-get source <package>` inside
  the running container, or from https://packages.ubuntu.com/
- **GitHub releases**: Source available at the GitHub URLs listed in the tables
  above
- **Homebrew formulae**: Source available via `brew info <formula>` or from the
  upstream project URLs

DevCage does not modify, patch, or create derivative works of any copyleft
component. The DevCage Docker image is a mere aggregation of independently
licensed programs as described in GPL Section 5 (GPLv2) / Section 5c (GPLv3).
DevCage's own scripts do not link against, call into, or form a combined work
with any GPL-licensed component.

To obtain the source code for any GPL-licensed component inside a running
DevCage container:

```bash
# Enable source repositories and download source
sudo apt-get update
apt-get source <package-name>
```
