Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: syft Upstream-Contact: Anchore, Inc. Source: https://github.com/anchore/syft Comment: Dependencies are not vendored: they are Debian golang-*-dev packages listed in Build-Depends, resolved by dh-go through the generated Go workspace. Files: * Copyright: 2020-2026 Anchore, Inc. License: Apache-2.0 Comment: Upstream names the holder itself, in a COPYRIGHT file that says "Copyright (c) Anchore, Inc.". It was added on 2026-10-12 in https://github.com/anchore/syft/commit/c2ea35ef328795647cfaabaf33e2ce74032f6e07, after https://github.com/anchore/syft/issues/5394 asked for one, and the LICENSE appendix was left as the Apache-2.0 boilerplate, "Copyright [yyyy] [name of copyright owner]". . That file is not in this release: it landed after 1.52.0 was tagged, so the tarball here does not contain it and this comment stands in for it. The first upstream release after 2026-10-12 ships the file and this comment can go. Upstream states no year, so the range above is this repository's history, from its first commit in 2020 to the current release. Files: debian/* Copyright: 2026 Juan Manuel Méndez Rey License: Apache-2.0 Files: schema/cyclonedx/cyclonedx.json schema/cyclonedx/cyclonedx.xsd schema/cyclonedx/spdx.schema.json schema/cyclonedx/spdx.xsd Copyright: OWASP Foundation 2020-2026 Anchore, Inc. License: Apache-2.0 Comment: Copies of the CycloneDX 1.7 schemas from https://github.com/CycloneDX/specification , kept in the tree so that xmllint and yajsv can validate generated output against local files instead of fetching the schemas over HTTP. spdx.xsd and spdx.schema.json are that project's own enumerations of SPDX license identifiers, not SPDX files. Anchore is named as well because schema/cyclonedx/README.md records that cyclonedx.xsd was edited here to reference the local spdx.xsd and to relax minOccurs on a license tag. The holder is the one that project states in its README: "CycloneDX Specification is Copyright (c) OWASP Foundation. All Rights Reserved." Files: schema/spdx-json/spdx-schema-2.3.json Copyright: 2010-2022 Linux Foundation and its Contributors License: CC-BY-3.0 Comment: The SPDX 2.3 JSON schema, used to validate the SPDX output of syft. It comes from https://github.com/spdx/spdx-spec and matches the 2.3.1 revision of schemas/spdx-schema.json except for the $schema and title fields. Holder and license are the ones that release states in chapters/index.md: "Copyright (c) 2010-2022 Linux Foundation and its Contributors. This work is licensed under the Creative Commons Attribution License 3.0 Unported". Files: internal/spdxlicense/generate/testdata/licenses.json Copyright: 2010-2022 Linux Foundation and its Contributors License: CC-BY-3.0 Comment: A copy of https://spdx.org/licenses/licenses.json, license list version 3.20, used as a fixture by the generator in internal/spdxlicense/generate. SPDX publishes the license list as part of the specification, under the terms quoted in the stanza above. internal/spdxlicense/license_list.go is generated from a later version of the same data and stays under Files: *, because it holds only the identifiers and their names. Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/python/dist-info/METADATA cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/python/somerequests-3.22.0.dist-info/METADATA syft/pkg/cataloger/python/testdata/site-packages/license/with-license-file-declared.dist-info/METADATA syft/pkg/cataloger/python/testdata/site-packages/license/without-license-file-declared.dist-info/METADATA syft/pkg/cataloger/python/testdata/site-packages/malformed-record/dist-info/METADATA syft/pkg/cataloger/python/testdata/site-packages/nested/dist-name/dist-info/METADATA syft/pkg/cataloger/python/testdata/site-packages/partial.dist-info/METADATA syft/pkg/cataloger/python/testdata/site-packages/uppercase/dist-name/DIST-INFO/METADATA test/cli/testdata/archive/dist-info/METADATA Copyright: 2006-2019 by the Pygments team License: BSD-2-clause Comment: Copies of the dist-info METADATA of Pygments 2.6.1, fixtures for the Python cataloger. Some have a field edited for one test, and one carries the name somerequests. The holder is the one the files themselves name. Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/python/egg-info/PKG-INFO cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/python/someotherpkg-3.19.0-py3.8.egg-info/PKG-INFO syft/pkg/cataloger/python/testdata/site-packages/nested/egg-name/egg-info/PKG-INFO syft/pkg/cataloger/python/testdata/site-packages/uppercase/egg-name/EGG-INFO/PKG-INFO Copyright: Kenneth Reitz License: Apache-2.0 Comment: Copies of the egg-info PKG-INFO of requests 2.22.0, fixtures for the Python cataloger. One carries the name someotherpkg. Files: syft/pkg/cataloger/python/testdata/site-packages/nested/egg-name/egg-info/PKG-INFO-INVALID syft/pkg/cataloger/python/testdata/site-packages/uppercase/egg-name/EGG-INFO/PKG-INFO-INVALID Copyright: The Apache Software Foundation License: Apache-2.0 Comment: Fixtures for the Python cataloger built from the metadata of Apache MXNet 1.8.0, whose Summary field holds the ASF license header. Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/r/base/DESCRIPTION syft/pkg/cataloger/r/testdata/installed/base/DESCRIPTION Copyright: R Core Team and contributors worldwide License: GPL-2 or GPL-3 Comment: The DESCRIPTION of the base package of R 4.3.0, a fixture for the R cataloger. It says "Part of R 4.3.0", and R is distributed under GPL-2 or GPL-3. Files: syft/pkg/cataloger/java/internal/maven/testdata/maven-repo/org/apache/commons/commons-parent/54/commons-parent-54.pom syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml syft/pkg/cataloger/java/testdata/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml syft/pkg/cataloger/java/testdata/pom/commons-codec.pom.xml syft/pkg/cataloger/java/testdata/pom/commons-text-1.10.0/pom.xml Copyright: The Apache Software Foundation License: Apache-2.0 Comment: Published Maven POMs of Apache Commons Parent, Commons Codec, Commons Text and the Apache Directory API, fixtures for the Java cataloger. Files: syft/pkg/cataloger/java/testdata/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml syft/pkg/cataloger/java/testdata/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml Copyright: 2007- Tatu Saloranta License: Apache-2.0 Comment: The published POM of jackson-core 2.15.2, a fixture for the Java cataloger. The holder is the one jackson-core-NOTICE states. Files: syft/pkg/cataloger/java/internal/maven/testdata/maven-repo/net/shibboleth/parent/7.11.2/parent-7.11.2.pom syft/pkg/cataloger/java/internal/maven/testdata/maven-repo/org/opensaml/opensaml-parent/3.4.6/opensaml-parent-3.4.6.pom syft/pkg/cataloger/java/testdata/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml Copyright: Shibboleth Project License: Apache-2.0 Comment: Published Maven POMs of the Shibboleth super POM and of OpenSAML 3.4.6, fixtures for the Java cataloger. The super POM declares Apache-2.0 and names no holder beyond the project itself at http://shibboleth.net/ . Files: syft/pkg/cataloger/java/testdata/jar-metadata/micronaut-aop-4.9.11/META-INF/maven/io.micronaut/micronaut-aop/pom.xml Copyright: 2017-2021 original authors License: Apache-2.0 Comment: The published POM of micronaut-aop 4.9.11, a fixture for the Java cataloger. The holder is the wording in the source headers of micronaut-core. Files: syft/pkg/cataloger/java/testdata/pom/neo4j-license-maven-plugin.pom.xml Copyright: Mathieu Carbou License: Apache-2.0 Comment: A copy of the POM of the Neo4j license-maven-plugin, which the file states in its first line, with its licenses block edited for a syft test. The holder is the organization the POM names. Files: syft/pkg/cataloger/java/internal/maven/testdata/maven-repo/org/junit/junit-bom/5.9.0/junit-bom-5.9.0.pom syft/pkg/cataloger/java/internal/maven/testdata/maven-repo/org/junit/junit-bom/5.9.1/junit-bom-5.9.1.pom syft/pkg/cataloger/java/testdata/jar-metadata/commons-lang3-3.12.0/META-INF/maven/org.apache.commons-lang3/pom.xml Copyright: 2015-2022 the original author or authors License: EPL-2.0 Comment: Published Maven POMs of the JUnit 5 bill of materials, fixtures for the Java cataloger. One of them sits under a commons-lang3 path with the coordinates edited, and is still JUnit's file. JUnit 5 is EPL-2.0, which these POMs declare themselves. Files: syft/pkg/cataloger/lua/testdata/rockspec/kong-3.7.0-0.rockspec syft/pkg/cataloger/lua/testdata/rockspec/kong-pgmoon-1.16.2-1.rockspec Copyright: Kong Inc License: Apache-2.0 Comment: Published rockspecs of Kong 3.7.0 and of Kong's build of pgmoon, fixtures for the Lua cataloger. pgmoon itself is Leaf Corcoran's work under Expat; the rockspec is Kong's and names Kong Inc as maintainer. Files: syft/pkg/cataloger/lua/testdata/rockspec/lpeg-1.0.2-1.rockspec syft/pkg/cataloger/lua/testdata/rockspec/luasyslog-2.0.1-1.rockspec Copyright: Gary V. Vaughan the luasyslog authors License: Expat Comment: Published rockspecs of LPeg 1.0.2 and luasyslog 2.0.1, fixtures for the Lua cataloger. The LPeg rockspec names its maintainer; the luasyslog one names no holder, so it is attributed to the project at https://github.com/lunarmodules/luasyslog . Files: internal/licenses/list.go Copyright: 2020 The Go Authors 2020-2026 Anchore, Inc. License: BSD-3-clause and Apache-2.0 Comment: The list of license file names comes from internal/licenses of https://github.com/golang/pkgsite , which the file says in a comment, and was extended in https://github.com/anchore/syft/pull/2227 . Files: syft/file/cataloger/executable/cataloger.go Copyright: 2018 Gabriel Vasile 2020-2026 Anchore, Inc. License: Expat and Apache-2.0 Comment: isMacho and classOrMachOFat are from internal/magic of https://github.com/gabriel-vasile/mimetype , which the file says in two comments. The rest of the file is Anchore's. Files: syft/pkg/cataloger/binary/testdata/classifiers/snippets/* syft/pkg/cataloger/binary/internal/manager/internal/testdata/snippets/* Copyright: the authors of each program, named by the first path component License: binary-fingerprints Comment: Fragments cut from released binaries, read by the binary classifier tests. debian/snippet-licences.txt gives the licence of every program and version, and where it was read. Files: syft/pkg/cataloger/debian/testdata/copyright/libc6 Copyright: 1991-2015 Free Software Foundation, Inc. 1991 Regents of the University of California 1993 Digital Equipment Corporation 1996-1999 Internet Software Consortium 2010 Oracle America, Inc. 1989-1991 Carnegie Mellon University 2000 Intel Corporation Craig Metz 1992 Eric Young 2002-2011 Simon Josefsson 1999-2000 Tom Tromey 2000 Red Hat, Inc. 2003 The Internet Society 1998 WIDE Project 1995 Tom Lord 1992-1997 Henry Spencer 1997-2003 University of Cambridge 1993 Sun Microsystems, Inc. C E Chew 2001 Stephen L. Moshier License: licence-corpus Comment: The copyright file of libc6 2.23, a fixture for syft's copyright parser. It quotes LGPL-2.1+, GPL-2+, the 4.4BSD, BIND, ISC and Sun RPC licences, two CMU licences, the Intel and Inner Net licences, the Internet Society notice on RFC 3492, and the notices of the other holders above. Files: syft/pkg/cataloger/debian/testdata/copyright/cuda Copyright: NVIDIA Corporation License: licence-corpus Comment: The NVIDIA CUDA Toolkit end user licence agreement, a fixture for syft's copyright parser. Files: internal/licenses/testdata/Knuth-CTAN Copyright: 2010-2022 Linux Foundation and its Contributors License: CC-BY-3.0 Comment: The Knuth CTAN License as the SPDX license list presents it, from https://ctan.org/license/knuth , a fixture for syft's licence detection. Files: internal/licenses/testdata/nvidia-software-and-cuda-supplement syft/pkg/cataloger/debian/testdata/copyright/dev-kit syft/pkg/cataloger/debian/testdata/copyright/microsoft Copyright: 2020-2026 Anchore, Inc. License: Apache-2.0 Comment: Fixtures that hold only the title of a licence agreement, so the parser is tested on recognising the title. Files: syft/pkg/cataloger/golang/testdata/xcoff/* Copyright: 2018 The Go Authors. All rights reserved. License: BSD-3-clause Comment: AIX XCOFF executables used as fixtures by the Go binary cataloger tests, taken from the Go project's own debug/xcoff testdata. Upstream removed the accompanying xcoff reader source in 1.44.0 in favour of the standard library; only the fixtures remain. Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/once/* cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/wrappy/* cmd/syft/internal/test/integration/testdata/npm-lock/package.json Copyright: Isaac Z. Schlueter and Contributors License: ISC Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/collapse-white-space/* Copyright: 2015 Titus Wormer License: Expat Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/end-of-stream/* cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/pump/* Copyright: 2014 Mathias Buus License: Expat Files: cmd/syft/internal/test/integration/testdata/npm-lock/node_modules/insert-css/* Copyright: James Halliday License: Expat Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/async/* cmd/syft/internal/test/integration/testdata/yarn-lock/packages/nested-package/node_modules/async/* Copyright: 2010-2018 Caolan McMahon License: Expat Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/merge-objects/* Copyright: 2015 Oleksii Shevchenko License: Expat Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/resize-observer-polyfill/* Copyright: 2016 Denis Rul License: Expat Files: cmd/syft/internal/test/integration/testdata/yarn-lock/node_modules/should-type/* Copyright: 2014 Denis Bardadym License: Expat Files: cmd/syft/internal/test/integration/testdata/yarn-lock/package.json cmd/syft/internal/test/integration/testdata/yarn-lock/packages/nested-package/package.json Copyright: 2020-2025 Anchore, Inc. License: Expat Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/wordpress/wp-content/plugins/akismet/akismet.php syft/pkg/cataloger/wordpress/testdata/glob-paths/wp-content/plugins/akismet/akismet.php Copyright: Automattic License: GPL-2+ Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/opam/ocaml-base-compiler.4.14.0/opam syft/pkg/cataloger/ocaml/testdata/ocaml-base-compiler.4.14.0/opam Copyright: Institut National de Recherche en Informatique et en Automatique License: LGPL-2.1 Files: cmd/syft/internal/test/integration/testdata/image-sbom-cataloger/test.spdx.json syft/format/internal/testutil/testdata/snapshot/TestSPDXTagValueImageEncoder.golden syft/format/spdxjson/testdata/identify/* syft/format/spdxjson/testdata/snapshot/* syft/format/spdxjson/testdata/spdx/* syft/format/spdxtagvalue/testdata/identify/* syft/format/spdxtagvalue/testdata/snapshot/* syft/format/spdxtagvalue/testdata/tag-value.spdx syft/pkg/cataloger/bitnami/testdata/tag-value/opt/bitnami/redis/.spdx-apache.spdx syft/pkg/cataloger/bitnami/testdata/json/opt/bitnami/postgresql/.spdx-postgresql.spdx syft/pkg/cataloger/bitnami/testdata/mix/opt/bitnami/render-template/.spdx-render-template.spdx syft/pkg/cataloger/bitnami/testdata/no-rel/opt/bitnami/redis/.spdx-redis.spdx Copyright: SPDX contributors License: CC0-1.0 Files: syft/pkg/cataloger/golang/testdata/licenses-vendor/github.com/!cap!o!r!g/!cap!project/LICENSE.txt syft/pkg/cataloger/golang/testdata/licenses/pkg/mod/github.com/!cap!o!r!g/!cap!project@v4.111.5/LICENSE.txt syft/pkg/cataloger/internal/licenses/testdata/LICENSE Comment: Test fixture LICENSE files containing MIT/Expat text, created by Anchore for testing the license detection engine. Copyright: 2020-2025 Anchore, Inc. License: Expat Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/node_modules/@actions/core/package.json Comment: Real package.json from GitHub Actions toolkit. Copyright: GitHub, Inc. License: Expat Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/node_modules/cowsay/package.json Comment: Real package.json from cowsay npm package. Copyright: Fabio Crisci License: Expat Files: syft/pkg/cataloger/r/testdata/installed/stringr/DESCRIPTION syft/pkg/cataloger/r/testdata/DESCRIPTION Comment: Real R CRAN DESCRIPTION files from the stringr package. Copyright: Hadley Wickham RStudio License: Expat Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/composer/composer.lock syft/pkg/cataloger/php/testdata/vendor/composer_1/installed.json syft/pkg/cataloger/php/testdata/vendor/composer_2/installed.json syft/pkg/cataloger/php/testdata/composer.lock syft/pkg/cataloger/javascript/testdata/pkg-json/package-repo-string.json syft/pkg/cataloger/javascript/testdata/pkg-lock/package-lock-2.json syft/pkg/cataloger/javascript/testdata/pnpm-remote/registry_response.json syft/pkg/cataloger/javascript/testdata/yarn-remote/registry_response.json syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithnestedlib/elfsrc/makefile syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc1/makefile syft/pkg/cataloger/binary/testdata/elf-testdata/elfbinwithsisterlib/elfsrc2/makefile syft/pkg/cataloger/r/testdata/map-parse/eof-multiline syft/pkg/cataloger/r/testdata/map-parse/multiline Comment: Anchore-created test fixtures. JSON/lock files contain license identifiers as structured data values describing other packages. The fixture files themselves are Apache-2.0. licensecheck misreads license strings in JSON content as the file's own license. Copyright: 2020-2025 Anchore, Inc. License: Apache-2.0 Files: syft/pkg/cataloger/javascript/testdata/pkg-lock/array-license-package-lock.json syft/pkg/cataloger/javascript/testdata/pkg-lock/alias-package-lock-2.json Comment: Anchore-created test fixtures for lockfile parsing. License identifiers in JSON content describe test packages, not the file itself. Copyright: 2020-2025 Anchore, Inc. License: Apache-2.0 Files: syft/pkg/cataloger/ocaml/testdata/alcotest.opam Copyright: Thomas Gazagnaire License: ISC Files: cmd/syft/internal/test/integration/testdata/image-pkg-coverage/pkgs/php/vendor/composer/installed.json syft/pkg/cataloger/conda/testdata/conda-meta-python-c-etc/conda-meta/jupyterlab-4.4.3-pyhd8ed1ab_0.json Comment: Anchore test fixtures. License identifiers in JSON describe other packages, not these files. Copyright: 2020-2025 Anchore, Inc. License: Apache-2.0 Files: syft/pkg/cataloger/conda/testdata/conda-meta-python-c-etc/conda-meta/zlib-1.2.11-h90dfc92_1014.json Comment: Conda metadata JSON describing zlib package. The "license" field in the JSON refers to the described package, not this file's own license. Copyright: 2020-2025 Anchore, Inc. License: Apache-2.0 Files: syft/pkg/cataloger/python/testdata/pypi-remote/registry_response.json Comment: Cached PyPI registry response describing certifi package (MPL-2.0). The JSON data file itself is Apache-2.0. Copyright: 2020-2025 Anchore, Inc. License: Apache-2.0 Files: syft/pkg/cataloger/python/testdata/site-packages/license/with-license-file-declared.dist-info/LICENSE.txt Copyright: 2010 Pallets License: BSD-3-clause Files: syft/pkg/cataloger/golang/testdata/repo/LICENSE Copyright: 2020-2025 Anchore, Inc. License: BSD-1-Clause Files: syft/format/testdata/alpine-syft.json syft/pkg/cataloger/sbom/testdata/alpine/syft-json/sbom.syft.json test/compare/testdata/acceptance-centos-8.2.2004.json Comment: These are syft SBOM JSON outputs that LIST packages with GPL-2 license identifiers as data values. The JSON files themselves are Apache-2.0 (generated by syft). licensecheck misreads JSON string values like "licenses": ["GPL-2.0-only"] as the file's own license. Copyright: 2020-2025 Anchore, Inc. License: Apache-2.0 Files: syft/pkg/cataloger/debian/testdata/copyright/libaudit-common syft/pkg/cataloger/debian/testdata/glob-paths/usr/share/doc/libpam-runtime/copyright syft/pkg/cataloger/debian/testdata/image-dpkg/usr/share/doc/libpam-runtime/copyright Copyright: 2012-2016 Steve Grubb 2007-2011 Philipp Matthias Hahn License: GPL-2 and LGPL-2.1 Comment: Copies of the Debian copyright file of libaudit-common, used as fixtures for the dpkg copyright parser. The two libpam-runtime files are byte for byte identical to the libaudit-common one, so they carry the same holders and licences despite their path. Files: syft/pkg/cataloger/debian/testdata/copyright/liblzma5 Copyright: 2006-2012 Lasse Collin 1999-2008 Igor Pavlov 2006 Ville Koskinen 1998 Steve Reid License: public-domain and LGPL-2.1+ and GPL-2+ and GPL-3+ Comment: A copy of the Debian copyright file of liblzma5 (XZ Utils), used as a fixture for the dpkg copyright parser. Its own summary states that liblzma is in the public domain, that the getopt_long code is LGPL-2.1+, that the gzip-derived scripts are GPL-2+, and that parts of the build system are GPL-2+ or GPL-3+. Files: syft/pkg/cataloger/debian/testdata/image-distroless-deb/usr/share/doc/libsqlite3-0/copyright Copyright: D. Richard Hipp 2006-2026 Laszlo Boszormenyi (GCS) 2005-2006 Tomas Fasth 2001-2005 Andreas Rottmann License: public-domain and GPL-2+ Comment: A copy of the Debian copyright file of libsqlite3-0, used as a fixture for the dpkg copyright parser. It declares sqlite3 itself public domain and its Debian packaging GPL-2+. Files: syft/pkg/cataloger/debian/testdata/copyright/trilicense Copyright: 1993 John Doe 1993 Joe Average License: GPL-2 and LGPL-2.1 and MPL-1.1 Files: syft/pkg/cataloger/debian/testdata/copyright/python Copyright: 2001-2026 Python Software Foundation 2000 BeOpen.com 1995-2001 Corporation for National Research Initiatives 1991-1995 Stichting Mathematisch Centrum License: PSF-2 and BeOpen and CNRI-Python and CWI and Apache-2.0 and Expat and Zlib and GPL-2+ Comment: A copy of the Debian copyright file of python, used as a fixture for the dpkg copyright parser. It reproduces the four Python history agreements in full, and a section headed "Files with other licenses than the Python License" with Apache-2.0, Expat and zlib notices. Its GNU Readline and OpenSSL entries are pointers to /usr/share/doc, not licence texts, and the GPL-2+ above is the Readline grant the file quotes. Files: syft/pkg/cataloger/python/testdata/site-packages/license/without-license-file-declared.dist-info/LICENSE.txt syft/pkg/cataloger/python/testdata/site-packages/nested/dist-name/dist-info/LICENSE.txt Copyright: 2010 Pallets License: BSD-3-clause Files: internal/licenses/testdata/multi-license Copyright: Emscripten contributors Joyent, Inc. and Node contributors Sam Lantinga Mihai Bazon WebGPU native developers David Schultz License: Expat and NCSA and Apache-2.0 and Zlib and BSD-2-clause and BSD-3-clause and public-domain Files: syft/pkg/apk_test.go Comment: This test file contains GPL-2 license identifiers as string constants for testing APK package metadata parsing. Copyright: 2020-2025 Anchore, Inc. License: Apache-2.0 License: Apache-2.0 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at . https://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. . On Debian systems, the complete text of the Apache License, Version 2.0 can be found in "/usr/share/common-licenses/Apache-2.0". License: Expat Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: . The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. License: BSD-3-clause Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: . 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. . 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. . 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. . THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. License: ISC Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. . THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. License: CC0-1.0 The person who associated a work with this deed has dedicated the work to the public domain by waiving all of his or her rights to the work worldwide under copyright law, including all related and neighboring rights, to the extent allowed by law. . You can copy, modify, distribute and perform the work, even for commercial purposes, all without asking permission. . On Debian systems, the complete text of the CC0 1.0 Universal license can be found in "/usr/share/common-licenses/CC0-1.0". License: LGPL-2.1+ On Debian systems, the complete text of the GNU Lesser General Public License, version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1". License: GPL-2 On Debian systems, the complete text of the GNU General Public License, version 2 can be found in "/usr/share/common-licenses/GPL-2". License: GPL-2+ On Debian systems, the complete text of the GNU General Public License, version 2 can be found in "/usr/share/common-licenses/GPL-2". License: MPL-1.1 On Debian systems, the complete text of the Mozilla Public License, version 1.1 can be found at "/usr/share/common-licenses/MPL-1.1". License: LGPL-2.1 On Debian systems, the complete text of the GNU Lesser General Public License, version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1". License: BSD-1-Clause Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: . 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. . THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. License: NCSA Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal with the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: . Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimers. . Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimers in the documentation and/or other materials provided with the distribution. . Neither the names of Mozilla, nor the names of its contributors may be used to endorse or promote products derived from this Software without specific prior written permission. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE SOFTWARE. License: CNRI-Python 1. This LICENSE AGREEMENT is between the Corporation for National Research Initiatives, having an office at 1895 Preston White Drive, Reston, VA 20191 ("CNRI"), and the Individual or Organization ("Licensee") accessing and otherwise using Python 1.6.1 software in source or binary form and its associated documentation. . 2. Subject to the terms and conditions of this License Agreement, CNRI hereby grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce, analyze, test, perform and/or display publicly, prepare derivative works, distribute, and otherwise use Python 1.6.1 alone or in any derivative version, provided, however, that CNRI's License Agreement and CNRI's notice of copyright, i.e., "Copyright (c) 1995-2001 Corporation for National Research Initiatives; All Rights Reserved" are retained in Python 1.6.1 alone or in any derivative version prepared by Licensee. Alternately, in lieu of CNRI's License Agreement, Licensee may substitute the following text (omitting the quotes): "Python 1.6.1 is made available subject to the terms and conditions in CNRI's License Agreement. This Agreement together with Python 1.6.1 may be located on the Internet using the following unique, persistent identifier (known as a handle): 1895.22/1013. This Agreement may also be obtained from a proxy server on the Internet using the following URL: http://hdl.handle.net/1895.22/1013". . 3. In the event Licensee prepares a derivative work that is based on or incorporates Python 1.6.1 or any part thereof, and wants to make the derivative work available to others as provided herein, then Licensee hereby agrees to include in any such work a brief summary of the changes made to Python 1.6.1. . 4. CNRI is making Python 1.6.1 available to Licensee on an "AS IS" basis. CNRI MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, CNRI MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 1.6.1 WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. . 5. CNRI SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON 1.6.1 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 1.6.1, OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. . 6. This License Agreement will automatically terminate upon a material breach of its terms and conditions. . 7. This License Agreement shall be governed by the federal intellectual property law of the United States, including without limitation the federal copyright law, and, to the extent such U.S. federal law does not apply, by the law of the Commonwealth of Virginia, excluding Virginia's conflict of law provisions. Notwithstanding the foregoing, with regard to derivative works based on Python 1.6.1 that incorporate non-separable material that was previously distributed under the GNU General Public License (GPL), the law of the Commonwealth of Virginia shall govern this License Agreement only as to issues arising under or with respect to Paragraphs 4, 5, and 7 of this License Agreement. Nothing in this License Agreement shall be deemed to create any relationship of agency, partnership, or joint venture between CNRI and Licensee. This License Agreement does not grant permission to use CNRI trademarks or trade name in a trademark sense to endorse or promote products or services of Licensee, or any third party. . 8. By clicking on the "ACCEPT" button where indicated, or by copying, installing or otherwise using Python 1.6.1, Licensee agrees to be bound by the terms and conditions of this License Agreement. . ACCEPT Files: syft/pkg/cataloger/golang/testdata/licenses/pkg/mod/github.com/someorg/somename@v0.3.2/LICENSE syft/pkg/cataloger/golang/testdata/licenses/pkg/mod/github.com/someorg/strangelicense@v1.2.3/LiCeNsE.tXt syft/pkg/cataloger/golang/testdata/licenses-vendor/github.com/someorg/somename/LICENSE syft/pkg/cataloger/golang/testdata/licenses-vendor/github.com/someorg/strangelicense/LiCeNsE.tXt Copyright: 2009-present Alibaba Cloud License: Apache-2.0 Comment: Apache-2.0 texts carrying Alibaba Cloud's notice, used as fixtures for the Go module licence classifier. The paths are made up by upstream; the files are real. Files: test/cli/testdata/attestation/config/dex/docker-compose-config.yaml test/cli/testdata/attestation/config/logid.sh test/cli/testdata/attestation/docker-compose-config.yaml Copyright: 2021 The Sigstore Authors License: Apache-2.0 License: Zlib This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software. . Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions: . 1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required. 2. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software. 3. This notice may not be removed or altered from any source distribution. License: BSD-2-clause Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. . THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. License: PSF-2 1. This LICENSE AGREEMENT is between the Python Software Foundation ("PSF"), and the Individual or Organization ("Licensee") accessing and otherwise using this software ("Python") in source or binary form and its associated documentation. . 2. Subject to the terms and conditions of this License Agreement, PSF hereby grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce, analyze, test, perform and/or display publicly, prepare derivative works, distribute, and otherwise use Python alone or in any derivative version, provided, however, that PSF's License Agreement and PSF's notice of copyright, i.e., "Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007 Python Software Foundation; All Rights Reserved" are retained in Python alone or in any derivative version prepared by Licensee. . 3. In the event Licensee prepares a derivative work that is based on or incorporates Python or any part thereof, and wants to make the derivative work available to others as provided herein, then Licensee hereby agrees to include in any such work a brief summary of the changes made to Python. . 4. PSF is making Python available to Licensee on an "AS IS" basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. . 5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON, OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. . 6. This License Agreement will automatically terminate upon a material breach of its terms and conditions. . 7. Nothing in this License Agreement shall be deemed to create any relationship of agency, partnership, or joint venture between PSF and Licensee. This License Agreement does not grant permission to use PSF trademarks or trade name in a trademark sense to endorse or promote products or services of Licensee, or any third party. . 8. By copying, installing or otherwise using Python, Licensee agrees to be bound by the terms and conditions of this License Agreement. License: BeOpen BEOPEN PYTHON OPEN SOURCE LICENSE AGREEMENT VERSION 1 . 1. This LICENSE AGREEMENT is between BeOpen.com ("BeOpen"), having an office at 160 Saratoga Avenue, Santa Clara, CA 95051, and the Individual or Organization ("Licensee") accessing and otherwise using this software in source or binary form and its associated documentation ("the Software"). . 2. Subject to the terms and conditions of this BeOpen Python License Agreement, BeOpen hereby grants Licensee a non-exclusive, royalty-free, world-wide license to reproduce, analyze, test, perform and/or display publicly, prepare derivative works, distribute, and otherwise use the Software alone or in any derivative version, provided, however, that the BeOpen Python License is retained in the Software, alone or in any derivative version prepared by Licensee. . 3. BeOpen is making the Software available to Licensee on an "AS IS" basis. BEOPEN MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, BEOPEN MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. . 4. BEOPEN SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF THE SOFTWARE FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF USING, MODIFYING OR DISTRIBUTING THE SOFTWARE, OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. . 5. This License Agreement will automatically terminate upon a material breach of its terms and conditions. . 6. This License Agreement shall be governed by and interpreted in all respects by the law of the State of California, excluding conflict of law provisions. Nothing in this License Agreement shall be deemed to create any relationship of agency, partnership, or joint venture between BeOpen and Licensee. This License Agreement does not grant permission to use BeOpen trademarks or trade names in a trademark sense to endorse or promote products or services of Licensee, or any third party. As an exception, the "BeOpen Python" logos available at http://www.pythonlabs.com/logos.html may be used according to the permissions granted on that web page. . 7. By copying, installing or otherwise using the software, Licensee agrees to be bound by the terms and conditions of this License Agreement. License: CWI Copyright (c) 1991 - 1995, Stichting Mathematisch Centrum Amsterdam, The Netherlands. All rights reserved. . Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Stichting Mathematisch Centrum or CWI not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission. . STICHTING MATHEMATISCH CENTRUM DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL STICHTING MATHEMATISCH CENTRUM BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. License: CC-BY-3.0 Creative Commons Legal Code . Attribution 3.0 Unported . CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL SERVICES. DISTRIBUTION OF THIS LICENSE DOES NOT CREATE AN ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES REGARDING THE INFORMATION PROVIDED, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM ITS USE. . License . THE WORK (AS DEFINED BELOW) IS PROVIDED UNDER THE TERMS OF THIS CREATIVE COMMONS PUBLIC LICENSE ("CCPL" OR "LICENSE"). THE WORK IS PROTECTED BY COPYRIGHT AND/OR OTHER APPLICABLE LAW. ANY USE OF THE WORK OTHER THAN AS AUTHORIZED UNDER THIS LICENSE OR COPYRIGHT LAW IS PROHIBITED. . BY EXERCISING ANY RIGHTS TO THE WORK PROVIDED HERE, YOU ACCEPT AND AGREE TO BE BOUND BY THE TERMS OF THIS LICENSE. TO THE EXTENT THIS LICENSE MAY BE CONSIDERED TO BE A CONTRACT, THE LICENSOR GRANTS YOU THE RIGHTS CONTAINED HERE IN CONSIDERATION OF YOUR ACCEPTANCE OF SUCH TERMS AND CONDITIONS. . 1. Definitions . a. "Adaptation" means a work based upon the Work, or upon the Work and other pre-existing works, such as a translation, adaptation, derivative work, arrangement of music or other alterations of a literary or artistic work, or phonogram or performance and includes cinematographic adaptations or any other form in which the Work may be recast, transformed, or adapted including in any form recognizably derived from the original, except that a work that constitutes a Collection will not be considered an Adaptation for the purpose of this License. For the avoidance of doubt, where the Work is a musical work, performance or phonogram, the synchronization of the Work in timed-relation with a moving image ("synching") will be considered an Adaptation for the purpose of this License. b. "Collection" means a collection of literary or artistic works, such as encyclopedias and anthologies, or performances, phonograms or broadcasts, or other works or subject matter other than works listed in Section 1(f) below, which, by reason of the selection and arrangement of their contents, constitute intellectual creations, in which the Work is included in its entirety in unmodified form along with one or more other contributions, each constituting separate and independent works in themselves, which together are assembled into a collective whole. A work that constitutes a Collection will not be considered an Adaptation (as defined above) for the purposes of this License. c. "Distribute" means to make available to the public the original and copies of the Work or Adaptation, as appropriate, through sale or other transfer of ownership. d. "Licensor" means the individual, individuals, entity or entities that offer(s) the Work under the terms of this License. e. "Original Author" means, in the case of a literary or artistic work, the individual, individuals, entity or entities who created the Work or if no individual or entity can be identified, the publisher; and in addition (i) in the case of a performance the actors, singers, musicians, dancers, and other persons who act, sing, deliver, declaim, play in, interpret or otherwise perform literary or artistic works or expressions of folklore; (ii) in the case of a phonogram the producer being the person or legal entity who first fixes the sounds of a performance or other sounds; and, (iii) in the case of broadcasts, the organization that transmits the broadcast. f. "Work" means the literary and/or artistic work offered under the terms of this License including without limitation any production in the literary, scientific and artistic domain, whatever may be the mode or form of its expression including digital form, such as a book, pamphlet and other writing; a lecture, address, sermon or other work of the same nature; a dramatic or dramatico-musical work; a choreographic work or entertainment in dumb show; a musical composition with or without words; a cinematographic work to which are assimilated works expressed by a process analogous to cinematography; a work of drawing, painting, architecture, sculpture, engraving or lithography; a photographic work to which are assimilated works expressed by a process analogous to photography; a work of applied art; an illustration, map, plan, sketch or three-dimensional work relative to geography, topography, architecture or science; a performance; a broadcast; a phonogram; a compilation of data to the extent it is protected as a copyrightable work; or a work performed by a variety or circus performer to the extent it is not otherwise considered a literary or artistic work. g. "You" means an individual or entity exercising rights under this License who has not previously violated the terms of this License with respect to the Work, or who has received express permission from the Licensor to exercise rights under this License despite a previous violation. h. "Publicly Perform" means to perform public recitations of the Work and to communicate to the public those public recitations, by any means or process, including by wire or wireless means or public digital performances; to make available to the public Works in such a way that members of the public may access these Works from a place and at a place individually chosen by them; to perform the Work to the public by any means or process and the communication to the public of the performances of the Work, including by public digital performance; to broadcast and rebroadcast the Work by any means including signs, sounds or images. i. "Reproduce" means to make copies of the Work by any means including without limitation by sound or visual recordings and the right of fixation and reproducing fixations of the Work, including storage of a protected performance or phonogram in digital form or other electronic medium. . 2. Fair Dealing Rights. Nothing in this License is intended to reduce, limit, or restrict any uses free from copyright or rights arising from limitations or exceptions that are provided for in connection with the copyright protection under copyright law or other applicable laws. . 3. License Grant. Subject to the terms and conditions of this License, Licensor hereby grants You a worldwide, royalty-free, non-exclusive, perpetual (for the duration of the applicable copyright) license to exercise the rights in the Work as stated below: . a. to Reproduce the Work, to incorporate the Work into one or more Collections, and to Reproduce the Work as incorporated in the Collections; b. to create and Reproduce Adaptations provided that any such Adaptation, including any translation in any medium, takes reasonable steps to clearly label, demarcate or otherwise identify that changes were made to the original Work. For example, a translation could be marked "The original work was translated from English to Spanish," or a modification could indicate "The original work has been modified."; c. to Distribute and Publicly Perform the Work including as incorporated in Collections; and, d. to Distribute and Publicly Perform Adaptations. e. For the avoidance of doubt: . i. Non-waivable Compulsory License Schemes. In those jurisdictions in which the right to collect royalties through any statutory or compulsory licensing scheme cannot be waived, the Licensor reserves the exclusive right to collect such royalties for any exercise by You of the rights granted under this License; ii. Waivable Compulsory License Schemes. In those jurisdictions in which the right to collect royalties through any statutory or compulsory licensing scheme can be waived, the Licensor waives the exclusive right to collect such royalties for any exercise by You of the rights granted under this License; and, iii. Voluntary License Schemes. The Licensor waives the right to collect royalties, whether individually or, in the event that the Licensor is a member of a collecting society that administers voluntary licensing schemes, via that society, from any exercise by You of the rights granted under this License. . The above rights may be exercised in all media and formats whether now known or hereafter devised. The above rights include the right to make such modifications as are technically necessary to exercise the rights in other media and formats. Subject to Section 8(f), all rights not expressly granted by Licensor are hereby reserved. . 4. Restrictions. The license granted in Section 3 above is expressly made subject to and limited by the following restrictions: . a. You may Distribute or Publicly Perform the Work only under the terms of this License. You must include a copy of, or the Uniform Resource Identifier (URI) for, this License with every copy of the Work You Distribute or Publicly Perform. You may not offer or impose any terms on the Work that restrict the terms of this License or the ability of the recipient of the Work to exercise the rights granted to that recipient under the terms of the License. You may not sublicense the Work. You must keep intact all notices that refer to this License and to the disclaimer of warranties with every copy of the Work You Distribute or Publicly Perform. When You Distribute or Publicly Perform the Work, You may not impose any effective technological measures on the Work that restrict the ability of a recipient of the Work from You to exercise the rights granted to that recipient under the terms of the License. This Section 4(a) applies to the Work as incorporated in a Collection, but this does not require the Collection apart from the Work itself to be made subject to the terms of this License. If You create a Collection, upon notice from any Licensor You must, to the extent practicable, remove from the Collection any credit as required by Section 4(b), as requested. If You create an Adaptation, upon notice from any Licensor You must, to the extent practicable, remove from the Adaptation any credit as required by Section 4(b), as requested. b. If You Distribute, or Publicly Perform the Work or any Adaptations or Collections, You must, unless a request has been made pursuant to Section 4(a), keep intact all copyright notices for the Work and provide, reasonable to the medium or means You are utilizing: (i) the name of the Original Author (or pseudonym, if applicable) if supplied, and/or if the Original Author and/or Licensor designate another party or parties (e.g., a sponsor institute, publishing entity, journal) for attribution ("Attribution Parties") in Licensor's copyright notice, terms of service or by other reasonable means, the name of such party or parties; (ii) the title of the Work if supplied; (iii) to the extent reasonably practicable, the URI, if any, that Licensor specifies to be associated with the Work, unless such URI does not refer to the copyright notice or licensing information for the Work; and (iv) , consistent with Section 3(b), in the case of an Adaptation, a credit identifying the use of the Work in the Adaptation (e.g., "French translation of the Work by Original Author," or "Screenplay based on original Work by Original Author"). The credit required by this Section 4 (b) may be implemented in any reasonable manner; provided, however, that in the case of a Adaptation or Collection, at a minimum such credit will appear, if a credit for all contributing authors of the Adaptation or Collection appears, then as part of these credits and in a manner at least as prominent as the credits for the other contributing authors. For the avoidance of doubt, You may only use the credit required by this Section for the purpose of attribution in the manner set out above and, by exercising Your rights under this License, You may not implicitly or explicitly assert or imply any connection with, sponsorship or endorsement by the Original Author, Licensor and/or Attribution Parties, as appropriate, of You or Your use of the Work, without the separate, express prior written permission of the Original Author, Licensor and/or Attribution Parties. c. Except as otherwise agreed in writing by the Licensor or as may be otherwise permitted by applicable law, if You Reproduce, Distribute or Publicly Perform the Work either by itself or as part of any Adaptations or Collections, You must not distort, mutilate, modify or take other derogatory action in relation to the Work which would be prejudicial to the Original Author's honor or reputation. Licensor agrees that in those jurisdictions (e.g. Japan), in which any exercise of the right granted in Section 3(b) of this License (the right to make Adaptations) would be deemed to be a distortion, mutilation, modification or other derogatory action prejudicial to the Original Author's honor and reputation, the Licensor will waive or not assert, as appropriate, this Section, to the fullest extent permitted by the applicable national law, to enable You to reasonably exercise Your right under Section 3(b) of this License (right to make Adaptations) but not otherwise. . 5. Representations, Warranties and Disclaimer . UNLESS OTHERWISE MUTUALLY AGREED TO BY THE PARTIES IN WRITING, LICENSOR OFFERS THE WORK AS-IS AND MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND CONCERNING THE WORK, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, WARRANTIES OF TITLE, MERCHANTIBILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR THE ABSENCE OF LATENT OR OTHER DEFECTS, ACCURACY, OR THE PRESENCE OF ABSENCE OF ERRORS, WHETHER OR NOT DISCOVERABLE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SUCH EXCLUSION MAY NOT APPLY TO YOU. . 6. Limitation on Liability. EXCEPT TO THE EXTENT REQUIRED BY APPLICABLE LAW, IN NO EVENT WILL LICENSOR BE LIABLE TO YOU ON ANY LEGAL THEORY FOR ANY SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES ARISING OUT OF THIS LICENSE OR THE USE OF THE WORK, EVEN IF LICENSOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. . 7. Termination . a. This License and the rights granted hereunder will terminate automatically upon any breach by You of the terms of this License. Individuals or entities who have received Adaptations or Collections from You under this License, however, will not have their licenses terminated provided such individuals or entities remain in full compliance with those licenses. Sections 1, 2, 5, 6, 7, and 8 will survive any termination of this License. b. Subject to the above terms and conditions, the license granted here is perpetual (for the duration of the applicable copyright in the Work). Notwithstanding the above, Licensor reserves the right to release the Work under different license terms or to stop distributing the Work at any time; provided, however that any such election will not serve to withdraw this License (or any other license that has been, or is required to be, granted under the terms of this License), and this License will continue in full force and effect unless terminated as stated above. . 8. Miscellaneous . a. Each time You Distribute or Publicly Perform the Work or a Collection, the Licensor offers to the recipient a license to the Work on the same terms and conditions as the license granted to You under this License. b. Each time You Distribute or Publicly Perform an Adaptation, Licensor offers to the recipient a license to the original Work on the same terms and conditions as the license granted to You under this License. c. If any provision of this License is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this License, and without further action by the parties to this agreement, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable. d. No term or provision of this License shall be deemed waived and no breach consented to unless such waiver or consent shall be in writing and signed by the party to be charged with such waiver or consent. e. This License constitutes the entire agreement between the parties with respect to the Work licensed here. There are no understandings, agreements or representations with respect to the Work not specified here. Licensor shall not be bound by any additional provisions that may appear in any communication from You. This License may not be modified without the mutual written agreement of the Licensor and You. f. The rights granted under, and the subject matter referenced, in this License were drafted utilizing the terminology of the Berne Convention for the Protection of Literary and Artistic Works (as amended on September 28, 1979), the Rome Convention of 1961, the WIPO Copyright Treaty of 1996, the WIPO Performances and Phonograms Treaty of 1996 and the Universal Copyright Convention (as revised on July 24, 1971). These rights and subject matter take effect in the relevant jurisdiction in which the License terms are sought to be enforced according to the corresponding provisions of the implementation of those treaty provisions in the applicable national law. If the standard suite of rights granted under applicable copyright law includes additional rights not granted under this License, such additional rights are deemed to be included in the License; this License is not intended to restrict the license of any rights under applicable law. . . Creative Commons Notice . Creative Commons is not a party to this License, and makes no warranty whatsoever in connection with the Work. Creative Commons will not be liable to You or any party on any legal theory for any damages whatsoever, including without limitation any general, special, incidental or consequential damages arising in connection to this license. Notwithstanding the foregoing two (2) sentences, if Creative Commons has expressly identified itself as the Licensor hereunder, it shall have all rights and obligations of Licensor. . Except for the limited purpose of indicating to the public that the Work is licensed under the CCPL, Creative Commons does not authorize the use by either party of the trademark "Creative Commons" or any related trademark or logo of Creative Commons without the prior written consent of Creative Commons. Any permitted use will be in compliance with Creative Commons' then-current trademark usage guidelines, as may be published on its website or otherwise made available upon request from time to time. For the avoidance of doubt, this trademark restriction does not form part of this License. . Creative Commons may be contacted at https://creativecommons.org/. License: EPL-2.0 Eclipse Public License - v 2.0 . THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT. . 1. DEFINITIONS . "Contribution" means: . a) in the case of the initial Contributor, the initial content Distributed under this Agreement, and . b) in the case of each subsequent Contributor: i) changes to the Program, and ii) additions to the Program; where such changes and/or additions to the Program originate from and are Distributed by that particular Contributor. A Contribution "originates" from a Contributor if it was added to the Program by such Contributor itself or anyone acting on such Contributor's behalf. Contributions do not include changes or additions to the Program that are not Modified Works. . "Contributor" means any person or entity that Distributes the Program. . "Licensed Patents" mean patent claims licensable by a Contributor which are necessarily infringed by the use or sale of its Contribution alone or when combined with the Program. . "Program" means the Contributions Distributed in accordance with this Agreement. . "Recipient" means anyone who receives the Program under this Agreement or any Secondary License (as applicable), including Contributors. . "Derivative Works" shall mean any work, whether in Source Code or other form, that is based on (or derived from) the Program and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. . "Modified Works" shall mean any work in Source Code or other form that results from an addition to, deletion from, or modification of the contents of the Program, including, for purposes of clarity any new file in Source Code form that contains any contents of the Program. Modified Works shall not include works that contain only declarations, interfaces, types, classes, structures, or files of the Program solely in each case in order to link to, bind by name, or subclass the Program or Modified Works thereof. . "Distribute" means the acts of a) distributing or b) making available in any manner that enables the transfer of a copy. . "Source Code" means the form of a Program preferred for making modifications, including but not limited to software source code, documentation source, and configuration files. . "Secondary License" means either the GNU General Public License, Version 2.0, or any later versions of that license, including any exceptions or additional permissions as identified by the initial Contributor. . 2. GRANT OF RIGHTS . a) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, Distribute and sublicense the Contribution of such Contributor, if any, and such Derivative Works. . b) Subject to the terms of this Agreement, each Contributor hereby grants Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed Patents to make, use, sell, offer to sell, import and otherwise transfer the Contribution of such Contributor, if any, in Source Code or other form. This patent license shall apply to the combination of the Contribution and the Program if, at the time the Contribution is added by the Contributor, such addition of the Contribution causes such combination to be covered by the Licensed Patents. The patent license shall not apply to any other combinations which include the Contribution. No hardware per se is licensed hereunder. . c) Recipient understands that although each Contributor grants the licenses to its Contributions set forth herein, no assurances are provided by any Contributor that the Program does not infringe the patent or other intellectual property rights of any other entity. Each Contributor disclaims any liability to Recipient for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, each Recipient hereby assumes sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow Recipient to Distribute the Program, it is Recipient's responsibility to acquire that license before distributing the Program. . d) Each Contributor represents that to its knowledge it has sufficient copyright rights in its Contribution, if any, to grant the copyright license set forth in this Agreement. . e) Notwithstanding the terms of any Secondary License, no Contributor makes additional grants to any Recipient (other than those set forth in this Agreement) as a result of such Recipient's receipt of the Program under the terms of a Secondary License (if permitted under the terms of Section 3). . 3. REQUIREMENTS . 3.1 If a Contributor Distributes the Program in any form, then: . a) the Program must also be made available as Source Code, in accordance with section 3.2, and the Contributor must accompany the Program with a statement that the Source Code for the Program is available under this Agreement, and informs Recipients how to obtain it in a reasonable manner on or through a medium customarily used for software exchange; and . b) the Contributor may Distribute the Program under a license different than this Agreement, provided that such license: i) effectively disclaims on behalf of all other Contributors all warranties and conditions, express and implied, including warranties or conditions of title and non-infringement, and implied warranties or conditions of merchantability and fitness for a particular purpose; . ii) effectively excludes on behalf of all other Contributors all liability for damages, including direct, indirect, special, incidental and consequential damages, such as lost profits; . iii) does not attempt to limit or alter the recipients' rights in the Source Code under section 3.2; and . iv) requires any subsequent distribution of the Program by any party to be under a license that satisfies the requirements of this section 3. . 3.2 When the Program is Distributed as Source Code: . a) it must be made available under this Agreement, or if the Program (i) is combined with other material in a separate file or files made available under a Secondary License, and (ii) the initial Contributor attached to the Source Code the notice described in Exhibit A of this Agreement, then the Program may be made available under the terms of such Secondary Licenses, and . b) a copy of this Agreement must be included with each copy of the Program. . 3.3 Contributors may not remove or alter any copyright, patent, trademark, attribution notices, disclaimers of warranty, or limitations of liability ("notices") contained within the Program from any copy of the Program which they Distribute, provided that Contributors may add their own appropriate notices. . 4. COMMERCIAL DISTRIBUTION . Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. Therefore, if a Contributor includes the Program in a commercial product offering, such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify every other Contributor ("Indemnified Contributor") against any losses, damages and costs (collectively "Losses") arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. The obligations in this section do not apply to any claims or Losses relating to any actual or alleged intellectual property infringement. In order to qualify, an Indemnified Contributor must: a) promptly notify the Commercial Contributor in writing of such claim, and b) allow the Commercial Contributor to control, and cooperate with the Commercial Contributor in, the defense and any related settlement negotiations. The Indemnified Contributor may participate in any such claim at its own expense. . For example, a Contributor might include the Program in a commercial product offering, Product X. That Contributor is then a Commercial Contributor. If that Commercial Contributor then makes performance claims, or offers warranties related to Product X, those performance claims and warranties are such Commercial Contributor's responsibility alone. Under this section, the Commercial Contributor would have to defend claims against the other Contributors related to those performance claims and warranties, and if a court requires any other Contributor to pay any damages as a result, the Commercial Contributor must pay those damages. . 5. NO WARRANTY . EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the Program and assumes all risks associated with its exercise of rights under this Agreement, including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations. . 6. DISCLAIMER OF LIABILITY . EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. . 7. GENERAL . If any provision of this Agreement is invalid or unenforceable under applicable law, it shall not affect the validity or enforceability of the remainder of the terms of this Agreement, and without further action by the parties hereto, such provision shall be reformed to the minimum extent necessary to make such provision valid and enforceable. . If Recipient institutes patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Program itself (excluding combinations of the Program with other software or hardware) infringes such Recipient's patent(s), then such Recipient's rights granted under Section 2(b) shall terminate as of the date such litigation is filed. . All Recipient's rights under this Agreement shall terminate if it fails to comply with any of the material terms or conditions of this Agreement and does not cure such failure in a reasonable period of time after becoming aware of such noncompliance. If all Recipient's rights under this Agreement terminate, Recipient agrees to cease use and distribution of the Program as soon as reasonably practicable. However, Recipient's obligations under this Agreement and any licenses granted by Recipient relating to the Program shall continue and survive. . Everyone is permitted to copy and distribute copies of this Agreement, but in order to avoid inconsistency the Agreement is copyrighted and may only be modified in the following manner. The Agreement Steward reserves the right to publish new versions (including revisions) of this Agreement from time to time. No one other than the Agreement Steward has the right to modify this Agreement. The Eclipse Foundation is the initial Agreement Steward. The Eclipse Foundation may assign the responsibility to serve as the Agreement Steward to a suitable separate entity. Each new version of the Agreement will be given a distinguishing version number. The Program (including Contributions) may always be Distributed subject to the version of the Agreement under which it was received. In addition, after a new version of the Agreement is published, Contributor may elect to Distribute the Program (including its Contributions) under the new version. . Except as expressly stated in Sections 2(a) and 2(b) above, Recipient receives no rights or licenses to the intellectual property of any Contributor under this Agreement, whether expressly, by implication, estoppel or otherwise. All rights in the Program not expressly granted under this Agreement are reserved. Nothing in this Agreement is intended to be enforceable by any entity that is not a Contributor or Recipient. No third-party beneficiary rights are created under this Agreement. . Exhibit A - Form of Secondary Licenses Notice . "This Source Code may also be made available under the following Secondary Licenses when the conditions for such availability set forth in the Eclipse Public License, v. 2.0 are satisfied: {name license(s), version(s), and exceptions or additional permissions here}." . Simply including a copy of this Agreement, including this Exhibit A is not sufficient to license the Source Code under Secondary Licenses. . If it is not possible or desirable to put the notice in a particular file, then You may include the notice in a location (such as a LICENSE file in a relevant directory) where a recipient would be likely to look for such a notice. . You may add additional accurate notices of copyright ownership. License: binary-fingerprints Each file holds a fragment of a released binary, at most 756 bytes and 120 at the median, cut at the offset of the program's version string. The tests use them to check that syft recognises a program and its version without shipping the program. 28 of them come from programs whose licences are not free, and debian/snippet-licences.txt names them. They are included under fair use, which needs no licence from the copyright holder, and are therefore suitable for main: https://lists.debian.org/debian-legal/2026/11/msg00004.html . License: licence-corpus Licence and copyright texts reproduced verbatim as test data for syft's licence and copyright detection. They are shipped as part of a licence scanner's corpus, on the reasoning in https://lists.debian.org/debian-legal/2026/10/msg00043.html . License: GPL-3 On Debian systems, the complete text of the GNU General Public License, version 3 can be found in "/usr/share/common-licenses/GPL-3". License: GPL-3+ On Debian systems, the complete text of the GNU General Public License, version 3 can be found in "/usr/share/common-licenses/GPL-3". License: public-domain The files declared public domain carry no copyright claim. The liblzma5 fixture states that liblzma itself is in the public domain, the libsqlite3-0 fixture that the sqlite3 contributors placed their files there, and the multi-license fixture includes the Unlicense dedication for tools/filelock.py.