WARN

==============================================================================
WARN -- warnings concerning LICENSE and NOTICE for the container image
Container image: docker.io/apache/openserverless-admin-api
==============================================================================

This file records warnings raised while regenerating the LICENSE and NOTICE
files beside it for the container image built from the Dockerfile. It is not
itself a license document.

ASF third-party licensing policy: https://www.apache.org/legal/resolved.html

  Category A  Apache-2.0 compatible. May be included in a release.
  Category B  May be included in BINARY form only, unmodified and as a
              separate file, with the reciprocal license disclosed.
  Category X  MUST NOT be included in an Apache release artifact.


==============================================================================
SCOPE
==============================================================================

The Apache release artifact for OpenServerless is the SOURCE distribution,
which contains the Dockerfile and the files beside it -- all Apache-2.0
licensed. The published container image is a CONVENIENCE BINARY assembled at
build time from a third-party base image and from package repositories.
LICENSE and NOTICE now cover both: the license above the first separator
applies to the source release, and each section below a separator applies to
software bundled only in the image.


==============================================================================
WARN 1 -- LICENSE and NOTICE were regenerated, previous content replaced
==============================================================================

  Severity : informational
  Detail   :
      The previous LICENSE and NOTICE carried a summary-table inventory with
      per-component license identifiers but NOT the license texts themselves;
      they pointed at paths inside the image instead. They have been rewritten
      in the style of the Apache Pekko LICENSE and NOTICE: Apache-2.0 text
      first, then '---------------' separated sections, with the full text of
      every non-Apache-2.0 license reproduced inline.
  Action   :
      Review the diff before cutting the release.


==============================================================================
WARN 2 -- previous inventory listed packages that are NOT in the image
==============================================================================

  Severity : correctness (resolved in the regenerated files)
  Detail   :
      The previous LICENSE/NOTICE listed 59 Python packages. The Dockerfile
      runs `uv pip install --requirement pyproject.toml`, which installs the
      default dependency group only -- the `dev` extra is never installed.
      Resolving pyproject.toml against uv.lock yields 43 packages.

      The following were listed but are NOT present in the runtime image and
      have been REMOVED from LICENSE and NOTICE:

          asttokens, colorama, decorator, executing, ipython,
          ipython-pygments-lexers, jedi, matplotlib-inline, parso, pexpect,
          prompt-toolkit, ptyprocess, pure-eval, pygments, stack-data,
          traitlets, wcwidth

      Over-disclosure is not a license violation, but it misstates the
      contents of the artifact and drags in licenses (ISC, BSD-2-Clause)
      that nothing in the image actually uses.
  Action   :
      None required. Note that if the Dockerfile is ever changed to install
      the dev extra, these packages must be restored.


==============================================================================
WARN 3 -- cffi is MIT No Attribution, not MIT
==============================================================================

  Severity : correctness (resolved in the regenerated files)
  Category : A
  Detail   :
      The previous inventory recorded cffi (2.0.0) as plain MIT. The license
      file shipped in cffi-2.0.0.dist-info/licenses/LICENSE is "MIT No
      Attribution" (MIT-0), a distinct, more permissive license. It is now
      reproduced in its own LICENSE section.
  Action   :
      None required. Both are Category A.


==============================================================================
WARN 4 -- CPython itself was never disclosed
==============================================================================

  Severity : omission (resolved in the regenerated files)
  Category : A
  Detail   :
      The image is built `FROM python:3.12-slim-bookworm` and ships the CPython
      runtime and standard library, which are the single largest bundled
      third-party component. Neither the previous LICENSE nor the previous
      NOTICE mentioned CPython or the Python Software Foundation License.
      The PSF License Version 2 text is now reproduced in LICENSE and the PSF
      copyright chain is recorded in NOTICE.
  Action   :
      None required.


==============================================================================
WARN 5 -- Category X inherited from the base image (GPL-2.0-or-later)
==============================================================================

  Severity : disclosure required
  Category : X (as bundled)
  Components:
      libpam-modules, libpam-modules-bin, libpam-runtime, libpam0g
      License: GPL-2.0-or-later AND BSD-3-Clause
      plus further reciprocally licensed Debian userland components.
  Detail   :
      These arrive from the python:3.12-slim-bookworm base image. The
      Dockerfile does not install them: its only `apt-get install` line adds
      curl, zip and unzip. They are therefore INHERITED, not added, and
      nothing in this service uses PAM authentication.

      The ASF does not redistribute these in source form; they are present
      only in the convenience binary. This is disclosed in both LICENSE and
      NOTICE.
  Action   :
      No removal possible without changing base image. Disclosure is the
      required and sufficient remedy. Do NOT add any further GPL component
      deliberately.


==============================================================================
WARN 6 -- Category B components (reciprocal, binary-only)
==============================================================================

  Severity : conditions must hold
  Components:
      certifi (2025.11.12)  -- MPL-2.0
      waitress (3.0.2)      -- ZPL-2.1
  Detail   :
      Category B permits inclusion in BINARY form only, unmodified and as a
      separate file, with the reciprocal license disclosed. Both are installed
      unmodified as separate wheels by uv and are not statically combined with
      or patched by OpenServerless code. Full MPL-2.0 reference and ZPL-2.1
      text are reproduced in LICENSE.

      Note: certifi's own license file states it contains a MODIFIED version
      of Mozilla's ca-bundle.crt. The modification is made by the certifi
      project upstream, not by OpenServerless; OpenServerless ships certifi
      unmodified. This satisfies Category B.
  Action   :
      None required. Do not patch either package in the image.


==============================================================================
WARN 7 -- copyright holders that could not be verified from the artifact
==============================================================================

  Severity : verify before release
  Detail   :
      Copyright lines in LICENSE and NOTICE were extracted from the license
      files actually shipped in each installed distribution. For a few
      components the shipped license file is the bare Apache-2.0 text with no
      copyright line, so the attribution was taken from package metadata or
      source headers instead:

          bcrypt     -- taken from METADATA Author-email
                        (The Python Cryptographic Authority developers)
          minio      -- taken from "(C) 2015-2021 MinIO, Inc." in source headers
          requests   -- taken from __version__.py (__copyright__)
          uv         -- NOT installed locally; uv is installed by pip at image
                        build time. Its attribution (Astral Software Inc.,
                        Apache-2.0 OR MIT) was not verified against a built
                        image.
          curl       -- Debian package; its copyright range and license text
                        were not read from the image.
          zip/unzip  -- Debian packages; Info-ZIP license text was not read
                        from the image.
          CPython    -- PSF copyright chain not read from the base image.

      Docker was unavailable in the environment where these files were
      regenerated, so no component was verified against an actually built
      image. The 43 Python packages WERE verified by resolving pyproject.toml
      against uv.lock and reading each installed dist-info.
  Action   :
      Before the release vote, build the image and confirm the Debian, uv and
      CPython attributions against /usr/share/doc/<pkg>/copyright and the
      base image, and adjust the corresponding LICENSE/NOTICE sections.


==============================================================================
WARN 8 -- LICENSE/NOTICE are copied to / in the image, not to a doc path
==============================================================================

  Severity : minor
  Detail   :
      The Dockerfile has:

          COPY DISCLAIMER LICENSE NOTICE  /

      WARN is NOT copied into the image, although both LICENSE and NOTICE
      refer the reader to "the WARN file beside this file". Inside the image
      that reference cannot be followed.
  Action   :
      Either add WARN to that COPY line, or drop the in-image cross-reference.
      Consider also placing the files under a conventional path such as
      /usr/share/doc/openserverless-admin-api/ in addition to /.


==============================================================================
WARN 9 -- dual-licensed components: no election recorded
==============================================================================

  Severity : informational
  Components:
      cryptography (50.0.0)  -- Apache-2.0 OR BSD-3-Clause
      packaging (25.0)       -- Apache-2.0 OR BSD-2-Clause
      uv                     -- Apache-2.0 OR MIT
  Detail   :
      These are offered under a choice of licenses. LICENSE reproduces both
      options for each rather than electing one, which is permissible but
      leaves the election implicit.
  Action   :
      Optional: state that the ASF elects Apache-2.0 for each, which
      simplifies the inventory.


==============================================================================
WARN 10 -- aiohttp is Apache-2.0 AND MIT
==============================================================================

  Severity : informational
  Category : A
  Detail   :
      aiohttp (3.14.3) declares "Apache-2.0 AND MIT" -- a conjunction, not a
      choice: it is Apache-2.0 licensed and vendors llhttp under MIT
      (Copyright (c) 2018 Fedor Indutny). Both are disclosed.
  Action   :
      None required.


==============================================================================
WARN 11 -- previously recorded removals are confirmed still absent
==============================================================================

  Severity : informational
  Detail   :
      The previous WARN recorded that the LGPL `psycopg`/`psycopg-binary`
      dependencies and the `telnet`/`inetutils-ping` packages had been
      removed. Both removals are confirmed against the current tree:
      pyproject.toml and uv.lock contain no psycopg, and the Dockerfile's
      apt install list is curl, zip, unzip only.
  Action   :
      None required. Do not reintroduce them.


==============================================================================
SUMMARY
==============================================================================

  Category X added deliberately by this Dockerfile : none
  Category X inherited from the base image         : GPL-2.0-or-later Debian
                                                     userland (disclosed,
                                                     WARN 5)
  Category B components                            : certifi, waitress
                                                     (conditions hold, WARN 6)
  Blocking issues                                  : none
  Open before release vote                         : WARN 7 (verify Debian /
                                                     uv / CPython attributions
                                                     against a built image)
                                                     WARN 8 (WARN not shipped
                                                     in image)