diff --git a/images/chromium-headful/Dockerfile b/images/chromium-headful/Dockerfile index 5c130fc1..7a106708 100644 --- a/images/chromium-headful/Dockerfile +++ b/images/chromium-headful/Dockerfile @@ -257,6 +257,9 @@ RUN apt-get update && \ COPY --from=ffmpeg-downloader /usr/local/bin/ffmpeg /usr/local/bin/ffmpeg COPY --from=ffmpeg-downloader /usr/local/bin/ffprobe /usr/local/bin/ffprobe +# third-party notices and license texts, readable in the running image +COPY shared/legal/THIRD-PARTY-NOTICES.txt /usr/share/doc/kernel/THIRD-PARTY-NOTICES.txt + # runtime ENV USERNAME=root RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=$CACHEIDPREFIX-apt-cache \ diff --git a/images/chromium-headless/image/Dockerfile b/images/chromium-headless/image/Dockerfile index 6c81d652..9f584d98 100644 --- a/images/chromium-headless/image/Dockerfile +++ b/images/chromium-headless/image/Dockerfile @@ -204,6 +204,9 @@ COPY shared/chromium-policies/managed/policy.json /etc/chromium/policies/managed COPY --from=ffmpeg-downloader /usr/local/bin/ffmpeg /usr/local/bin/ffmpeg COPY --from=ffmpeg-downloader /usr/local/bin/ffprobe /usr/local/bin/ffprobe +# third-party notices and license texts, readable in the running image +COPY shared/legal/THIRD-PARTY-NOTICES.txt /usr/share/doc/kernel/THIRD-PARTY-NOTICES.txt + # Remove upower to prevent spurious D-Bus activations and logs RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=$CACHEIDPREFIX-apt-cache \ --mount=type=cache,target=/var/lib/apt,sharing=locked,id=$CACHEIDPREFIX-apt-lib \ diff --git a/shared/legal/THIRD-PARTY-NOTICES.txt b/shared/legal/THIRD-PARTY-NOTICES.txt new file mode 100644 index 00000000..660977f7 --- /dev/null +++ b/shared/legal/THIRD-PARTY-NOTICES.txt @@ -0,0 +1,98 @@ +KERNEL BROWSER IMAGES - THIRD-PARTY NOTICES +=========================================== + +This image contains open source software. This file lists the components whose +licenses require attribution, and where to obtain the corresponding source. + +Full license texts for the software installed from the Ubuntu archive are in +/usr/share/doc//copyright inside this image. + + +1. CHROMIUM +----------- +This image runs a Chromium build: Chrome for Testing 155.0.8059.84 in the +public images, and Kernel's build of Chromium at the same upstream version in +the private images. + +Chromium is licensed under the BSD 3-Clause license and incorporates several +hundred third-party components under their own licenses. The complete list, +with each component's license text, is available at: + + chrome://credits + +inside any running browser, and upstream at: + + https://chromium.googlesource.com/chromium/src/+/refs/tags/155.0.8059.84 + +A small number of Chromium files are licensed under the GNU Lesser General +Public License (LGPL-2.0-or-later), and in Kernel's build some of them are +modified. Those files are: + + third_party/blink/renderer/core/frame/navigator.cc + third_party/blink/renderer/core/page/page.cc + +The complete source of those files, as they appear in this build, together with +the changes applied, is published at: + + https://github.com/kernel/oss-source + +Chromium's bundled FFmpeg, statically linked into the browser, is licensed under +LGPL-2.1-or-later. In Kernel's build its configuration files are modified to +enable the HEVC decoder; the modified source is published at the same location. + +Widevine CDM, present in Chromium's distribution, is proprietary software of +Google LLC and is not open source. + + +2. FFMPEG (STANDALONE) +---------------------- +This image contains an unmodified FFmpeg binary at /usr/local/bin/ffmpeg, with +ffprobe alongside it, used by the session recorder. It is a separate program: +nothing in Kernel's software links against it. + + version: n7.1.5-12-g1fdbca85aa + license: GPL-3.0-or-later (built with --enable-gpl --enable-version3) + source: https://github.com/kernel/oss-source/releases/tag/ffmpeg-n7.1.5-12-g1fdbca85aa + +That release contains the FFmpeg source at the commit this binary was built +from, and the build scripts used to compile it. The exact configure flags are +printed by running `ffmpeg -version` inside this image. + + +3. UBUNTU 22.04 PACKAGES +------------------------ +This image is built from Ubuntu 22.04 and installs packages from the Ubuntu +archive. Their licenses and copyright notices are at: + + /usr/share/doc//copyright + +Corresponding source for any Ubuntu package is available from +https://archive.ubuntu.com/ubuntu/ and https://launchpad.net/ubuntu at the +version installed in this image, which `dpkg-query -W` reports. + +One installed package is licensed under the GNU Affero General Public License: + + fonts-urw-base35 AGPL-3.0 with font exception + +The font exception applies; the package contains font data and is not offered +as a network service. + + +4. OTHER COMPONENTS +------------------- + Node.js 22.x MIT + npm, and packages installed with it permissive (MIT, ISC, Apache-2.0, BSD) + Envoy 1.32.x Apache-2.0 + Docker Engine, containerd, runc Apache-2.0 + Supervisor (Python) BSD-derived + + +5. OBTAINING SOURCE +------------------- +If any source referenced in this file is not reachable, contact +legal@kernel.sh and Kernel will provide it. + + +This file covers open source components. Proprietary third-party components +bundled in this image are tracked separately in Kernel's third-party vendor +list.