# Third-Party Notices

Crewship itself is licensed under Apache-2.0 — see [LICENSE](./LICENSE).

Crewship would not exist without the work of hundreds of upstream maintainers.
This file is the formal acknowledgement and license attribution for every
third-party package the binary and the embedded UI ship with.

## Embedded data

`internal/modelcatalog/data/models.dev.json` is a trimmed snapshot of the
[models.dev](https://github.com/anomalyco/models.dev) provider/model catalogue.
It is distributed under the MIT License:

> Copyright (c) 2025 models.dev
>
> Permission is hereby granted, free of charge, to any person obtaining a copy
> of this software and associated documentation files (the "Software"), to deal
> in the Software without restriction, including without limitation the rights
> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> copies of the Software, and to permit persons to whom the Software is
> furnished to do so, subject to the following conditions:
>
> The above copyright notice and this permission notice shall be included in
> all copies or substantial portions of the Software.
>
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
> SOFTWARE.

## Mooring canonical JSON

Mooring imports [`github.com/gowebpki/jcs` v1.0.2](https://github.com/gowebpki/jcs/tree/v1.0.2),
licensed under Apache-2.0. Copyright 2021–2026 Bret Jordan & Benedikt Thoma;
copyright 2006–2019 WebPKI.org. The [exact upstream license](internal/mooring/licenses/jcs-v1.0.2-LICENSE.txt)
is retained with the [version and parser audit](internal/mooring/licenses/README.md).

## Offline Slides PDF foundation

The standalone Slides PDF renderer uses
[`github.com/signintech/gopdf` v0.38.3](https://github.com/signintech/gopdf/tree/v0.38.3)
(tag `072bc5c7fe48b44210dc81e1f029fd7bd2d710e0`, MIT, copyright 2015 signintech),
with transitive [`github.com/phpdave11/gofpdi`](https://github.com/phpdave11/gofpdi/tree/1f10f9844311)
(MIT, copyright 2019–2020 David Barnes and 2017 Setasign – Jan Slabon).
Exact upstream notices are retained in
[`internal/artifacts/slidespdf/licenses/`](internal/artifacts/slidespdf/licenses/).
The fixed embedded Go Regular font comes from `golang.org/x/image` v0.47.0,
copyright 2016 Bigelow & Holmes Inc., under its BSD-style Go font license;
that exact font notice is retained in the same directory.
The authored Slides read/export entrypoints link this renderer into the binary.
Runtime access remains disabled by default behind `artifact_slides`; the Go
dependency inventory below includes its linked dependencies.

## Slides rich profile: fonts and icons

The schema-3 Slides profile embeds IBM Plex Sans 1.1.0 (Regular, SemiBold,
Bold; copyright 2017 IBM Corp., Reserved Font Name "Plex") and JetBrains Mono
2.304 (Regular, SemiBold; copyright 2020 The JetBrains Mono Project Authors),
both under the SIL Open Font License 1.1. The PDF renderer embeds the unmodified
TTF files in
[`internal/artifacts/slidespdf/fonts/`](internal/artifacts/slidespdf/fonts/README.md)
with the notices in
[`internal/artifacts/slidespdf/licenses/`](internal/artifacts/slidespdf/licenses/);
the web app serves the unmodified WOFF2 files from
[`public/fonts/ibm-plex-sans/`](public/fonts/ibm-plex-sans/README.md) and
`public/fonts/jetbrains-mono/`, each with its `OFL.txt`.

The Slides icon allow-list
[`internal/slides/lucide_icons.json`](internal/slides/lucide_icons.json) is
geometry copied from `lucide-react` 1.66.0 by `scripts/gen-slides-icons.mjs`
(ISC, copyright 2026 Lucide Icons and Contributors; parts derived from
Feather, MIT). Its notice is retained in
[`internal/artifacts/slidespdf/licenses/lucide-LICENSE.txt`](internal/artifacts/slidespdf/licenses/lucide-LICENSE.txt).

## Artifact Slides font

The packaged Go Regular font in `public/fonts/go-regular/Go-Regular.ttf` is
identical to `golang.org/x/image/font/gofont/goregular` v0.47.0, copyright
2016 Bigelow & Holmes Inc. Its BSD-style Go font notice is retained in
[`public/fonts/go-regular/LICENSE.txt`](public/fonts/go-regular/LICENSE.txt).

## Go dependencies

Sections below list every direct + transitive Go dependency of the `crewship`
binary and their licenses. Auto-generated by `make notices` via
[go-licenses](https://github.com/google/go-licenses); do not edit by hand —
re-run `make notices` after any dependency change.

**Known exception:** `modernc.org/mathutil` is BSD-3-Clause (verified in its
`LICENSE` file) but `go-licenses` cannot auto-detect it due to a file-matching
edge case. It is excluded from the automated check and listed manually below.

## Frontend (npm) dependencies

The Next.js bundle embedded in the binary pulls in roughly 750 npm packages
(production only), the vast majority MIT or ISC. The full per-package list
is *not* committed here because it duplicates `pnpm-lock.yaml` and changes
on every dep bump.

To produce the full list locally:

```bash
pnpm licenses list --prod --long
```

To get a per-license-type breakdown:

```bash
pnpm licenses list --prod --json | jq 'to_entries | map({license: .key, count: (.value | length)})'
```

Aggregate license breakdown as of the latest release (informational):
Apache-2.0, MIT, ISC, BSD-2-Clause, BSD-3-Clause, MPL-2.0, LGPL-3.0-or-later,
CC-BY-4.0, Unlicense. All compatible with Apache-2.0 redistribution.

### Agent avatar artwork — DiceBear

Agent avatars are drawn in the browser by [DiceBear](https://www.dicebear.com).
The library code is MIT (`@dicebear/core` 9.4.3, and 10.7.0 under the npm alias
`@dicebear/core-v10`). Each avatar **style** carries its own artwork licence,
and every generated SVG repeats it in its `<metadata>` block (creator, source
and licence), so a saved avatar keeps its attribution.

- **Voxel Bot** and **Voxel Art** (`voxel-bot`, `voxel-art`), the default since
  #3789, come from `@dicebear/styles` 10.6.0 (npm alias `@dicebear/styles-v10`).
  Both are by DiceBear and dedicated to the public domain under
  [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/). No attribution
  is required; it is given here anyway. That package's `LICENSE.md` lists the
  licence of every style it contains; only these two are used.
- The other 25 styles come from the per-style `@dicebear/*` 9.4.2 packages,
  each under the licence its own package declares: MIT (8 styles),
  MIT AND CC-BY-4.0 (13), or the terms in the package's own LICENSE file (4).

### LGPL-3.0 exception note — `@img/sharp-libvips-*`

Crewship transitively depends on `@img/sharp-libvips-<platform>-<arch>`
(via `sharp`, which Next.js uses for image optimization). These platform
packages bundle the libvips native library under LGPL-3.0-or-later.

The LGPL-3.0 license is **compatible with Apache-2.0 redistribution**
under the following terms, which Crewship's distribution satisfies:

1. **Dynamic linking only.** Crewship distributes libvips as a dynamic
   library inside the npm package; the Go binary and Next.js bundle do
   not statically link it. LGPL §4(d)(0) permits dynamic-linked LGPL
   binaries inside otherwise-Apache works.
2. **User-replaceable.** Operators who want to substitute their own
   build of libvips can do so by replacing the `node_modules/@img/`
   directory before `pnpm build`. No build flag forbids this.
3. **Source availability.** The libvips source for the bundled version
   is published at https://github.com/libvips/libvips/. The exact
   commit corresponding to each release is captured in the binary
   package's `versions.json` (see `node_modules/@img/sharp-libvips-*/`).
4. **Notice retention.** This document preserves the LGPL-3.0
   attribution required by §5 of the licence.

If you redistribute Crewship downstream and modify libvips itself, you
must publish the modified libvips source under LGPL-3.0; the Apache-2.0
core remains under Apache-2.0. If you want a Crewship build with **no**
LGPL component, replace `sharp` with a pure-Go or Apache/MIT-licensed
image processor before `pnpm build` — no source-code surgery in
`crewship` itself is required.

## Go dependency list

| Package | License | Source URL |
|---------|---------|------------|
| `cloud.google.com/go/compute/metadata` | Apache-2.0 | https://github.com/googleapis/google-cloud-go/blob/compute/metadata/v0.3.0/compute/metadata/LICENSE |
| `github.com/alecthomas/chroma/v2` | MIT | https://github.com/alecthomas/chroma/blob/v2.20.0/COPYING |
| `github.com/atotto/clipboard` | BSD-3-Clause | https://github.com/atotto/clipboard/blob/v0.1.4/LICENSE |
| `github.com/aymanbagabas/go-osc52/v2` | MIT | https://github.com/aymanbagabas/go-osc52/blob/v2.0.1/LICENSE |
| `github.com/aymerick/douceur` | MIT | https://github.com/aymerick/douceur/blob/v0.2.0/LICENSE |
| `github.com/catppuccin/go` | MIT | https://github.com/catppuccin/go/blob/v0.3.0/LICENSE |
| `github.com/cespare/xxhash/v2` | MIT | https://github.com/cespare/xxhash/blob/v2.3.0/LICENSE.txt |
| `github.com/charmbracelet/bubbles` | MIT | https://github.com/charmbracelet/bubbles/blob/23b8fd6302d7/LICENSE |
| `github.com/charmbracelet/bubbletea` | MIT | https://github.com/charmbracelet/bubbletea/blob/v1.3.6/LICENSE |
| `github.com/charmbracelet/colorprofile` | MIT | https://github.com/charmbracelet/colorprofile/blob/f60798e515dc/LICENSE |
| `github.com/charmbracelet/glamour` | MIT | https://github.com/charmbracelet/glamour/blob/v1.0.0/LICENSE |
| `github.com/charmbracelet/huh` | MIT | https://github.com/charmbracelet/huh/blob/v1.0.0/LICENSE |
| `github.com/charmbracelet/lipgloss` | MIT | https://github.com/charmbracelet/lipgloss/blob/76690c660834/LICENSE |
| `github.com/charmbracelet/x/ansi` | MIT | https://github.com/charmbracelet/x/blob/ansi/v0.10.2/ansi/LICENSE |
| `github.com/charmbracelet/x/cellbuf` | MIT | https://github.com/charmbracelet/x/blob/cellbuf/v0.0.13/cellbuf/LICENSE |
| `github.com/charmbracelet/x/exp/slice` | MIT | https://github.com/charmbracelet/x/blob/2fdc97757edf/exp/slice/LICENSE |
| `github.com/charmbracelet/x/exp/strings` | MIT | https://github.com/charmbracelet/x/blob/212f7b056ed0/exp/strings/LICENSE |
| `github.com/charmbracelet/x/term` | MIT | https://github.com/charmbracelet/x/blob/term/v0.2.1/term/LICENSE |
| `github.com/containerd/errdefs/pkg` | Apache-2.0 | https://github.com/containerd/errdefs/blob/pkg/v0.3.0/pkg/LICENSE |
| `github.com/containerd/errdefs` | Apache-2.0 | https://github.com/containerd/errdefs/blob/v1.0.0/LICENSE |
| `github.com/crewship-ai/crewship` | Apache-2.0 | https://github.com/crewship-ai/crewship/blob/HEAD/LICENSE |
| `github.com/distribution/reference` | Apache-2.0 | https://github.com/distribution/reference/blob/v0.6.0/LICENSE |
| `github.com/dlclark/regexp2` | MIT | https://github.com/dlclark/regexp2/blob/v1.11.5/LICENSE |
| `github.com/docker/go-connections` | Apache-2.0 | https://github.com/docker/go-connections/blob/v0.6.0/LICENSE |
| `github.com/docker/go-units` | Apache-2.0 | https://github.com/docker/go-units/blob/v0.5.0/LICENSE |
| `github.com/dustin/go-humanize` | MIT | https://github.com/dustin/go-humanize/blob/v1.0.1/LICENSE |
| `github.com/felixge/httpsnoop` | MIT | https://github.com/felixge/httpsnoop/blob/v1.0.4/LICENSE.txt |
| `github.com/fsnotify/fsnotify` | BSD-3-Clause | https://github.com/fsnotify/fsnotify/blob/v1.9.0/LICENSE |
| `github.com/go-jose/go-jose/v4/json` | BSD-3-Clause | https://github.com/go-jose/go-jose/blob/v4.1.4/json/LICENSE |
| `github.com/go-jose/go-jose/v4` | Apache-2.0 | https://github.com/go-jose/go-jose/blob/v4.1.4/LICENSE |
| `github.com/go-logr/logr` | Apache-2.0 | https://github.com/go-logr/logr/blob/v1.4.3/LICENSE |
| `github.com/go-logr/stdr` | Apache-2.0 | https://github.com/go-logr/stdr/blob/v1.2.2/LICENSE |
| `github.com/google/jsonschema-go/jsonschema` | MIT | https://github.com/google/jsonschema-go/blob/v0.4.3/LICENSE |
| `github.com/google/uuid` | BSD-3-Clause | https://github.com/google/uuid/blob/v1.6.0/LICENSE |
| `github.com/gorilla/css/scanner` | BSD-3-Clause | https://github.com/gorilla/css/blob/v1.0.1/LICENSE |
| `github.com/gorilla/websocket` | BSD-2-Clause | https://github.com/gorilla/websocket/blob/v1.5.3/LICENSE |
| `github.com/lucasb-eyer/go-colorful` | MIT | https://github.com/lucasb-eyer/go-colorful/blob/v1.3.0/LICENSE |
| `github.com/mattn/go-isatty` | MIT | https://github.com/mattn/go-isatty/blob/v0.0.20/LICENSE |
| `github.com/mattn/go-runewidth` | MIT | https://github.com/mattn/go-runewidth/blob/v0.0.17/LICENSE |
| `github.com/microcosm-cc/bluemonday` | BSD-3-Clause | https://github.com/microcosm-cc/bluemonday/blob/v1.0.27/LICENSE.md |
| `github.com/mitchellh/hashstructure/v2` | MIT | https://github.com/mitchellh/hashstructure/blob/v2.0.2/LICENSE |
| `github.com/moby/docker-image-spec/specs-go/v1` | Apache-2.0 | https://github.com/moby/docker-image-spec/blob/v1.3.1/LICENSE |
| `github.com/moby/moby/api` | Apache-2.0 | https://github.com/moby/moby/blob/api/v1.55.0/LICENSE |
| `github.com/moby/moby/client` | Apache-2.0 | https://github.com/moby/moby/blob/client/v0.5.0/LICENSE |
| `github.com/modelcontextprotocol/go-sdk` | Apache-2.0 | https://github.com/modelcontextprotocol/go-sdk/blob/v1.8.0/LICENSE |
| `github.com/muesli/ansi` | MIT | https://github.com/muesli/ansi/blob/276c6243b2f6/LICENSE |
| `github.com/muesli/cancelreader` | MIT | https://github.com/muesli/cancelreader/blob/v0.2.2/LICENSE |
| `github.com/muesli/reflow` | MIT | https://github.com/muesli/reflow/blob/v0.3.0/LICENSE |
| `github.com/muesli/termenv` | MIT | https://github.com/muesli/termenv/blob/v0.16.0/LICENSE |
| `github.com/ncruces/go-strftime` | MIT | https://github.com/ncruces/go-strftime/blob/v1.0.0/LICENSE |
| `github.com/opencontainers/go-digest` | Apache-2.0 | https://github.com/opencontainers/go-digest/blob/v1.0.0/LICENSE |
| `github.com/opencontainers/image-spec/specs-go` | Apache-2.0 | https://github.com/opencontainers/image-spec/blob/v1.1.1/LICENSE |
| `github.com/pkg/errors` | BSD-2-Clause | https://github.com/pkg/errors/blob/v0.9.1/LICENSE |
| `github.com/remyoudompheng/bigfft` | BSD-3-Clause | https://github.com/remyoudompheng/bigfft/blob/24d4a6f8daec/LICENSE |
| `github.com/rivo/uniseg` | MIT | https://github.com/rivo/uniseg/blob/v0.4.7/LICENSE.txt |
| `github.com/robfig/cron/v3` | MIT | https://github.com/robfig/cron/blob/v3.0.1/LICENSE |
| `github.com/segmentio/asm` | MIT | https://github.com/segmentio/asm/blob/v1.1.3/LICENSE |
| `github.com/segmentio/encoding` | MIT | https://github.com/segmentio/encoding/blob/v0.5.4/LICENSE |
| `github.com/spf13/cobra` | Apache-2.0 | https://github.com/spf13/cobra/blob/v1.10.2/LICENSE.txt |
| `github.com/spf13/pflag` | BSD-3-Clause | https://github.com/spf13/pflag/blob/v1.0.9/LICENSE |
| `github.com/xo/terminfo` | MIT | https://github.com/xo/terminfo/blob/abceb7e1c41e/LICENSE |
| `github.com/yosida95/uritemplate/v3` | BSD-3-Clause | https://github.com/yosida95/uritemplate/blob/v3.0.2/LICENSE |
| `github.com/yuin/goldmark-emoji` | MIT | https://github.com/yuin/goldmark-emoji/blob/v1.0.6/LICENSE |
| `github.com/yuin/goldmark` | MIT | https://github.com/yuin/goldmark/blob/v1.7.13/LICENSE |
| `go.etcd.io/bbolt` | MIT | https://github.com/etcd-io/bbolt/blob/v1.4.3/LICENSE |
| `go.opentelemetry.io/auto/sdk` | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-go-instrumentation/blob/sdk/v1.2.1/sdk/LICENSE |
| `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/net/http/otelhttp/v0.65.0/instrumentation/net/http/otelhttp/LICENSE |
| `go.opentelemetry.io/otel/metric` | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-go/blob/metric/v1.40.0/metric/LICENSE |
| `go.opentelemetry.io/otel/trace` | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-go/blob/trace/v1.40.0/trace/LICENSE |
| `go.opentelemetry.io/otel` | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-go/blob/v1.40.0/LICENSE |
| `golang.org/x/crypto` | BSD-3-Clause | https://cs.opensource.google/go/x/crypto/+/v0.49.0:LICENSE |
| `golang.org/x/net` | BSD-3-Clause | https://cs.opensource.google/go/x/net/+/v0.52.0:LICENSE |
| `golang.org/x/oauth2` | BSD-3-Clause | https://cs.opensource.google/go/x/oauth2/+/v0.36.0:LICENSE |
| `golang.org/x/sync/errgroup` | BSD-3-Clause | https://cs.opensource.google/go/x/sync/+/v0.20.0:LICENSE |
| `golang.org/x/sys/unix` | BSD-3-Clause | https://cs.opensource.google/go/x/sys/+/v0.42.0:LICENSE |
| `golang.org/x/term` | BSD-3-Clause | https://cs.opensource.google/go/x/term/+/v0.41.0:LICENSE |
| `golang.org/x/text` | BSD-3-Clause | https://cs.opensource.google/go/x/text/+/v0.35.0:LICENSE |
| `gopkg.in/yaml.v3` | MIT | https://github.com/go-yaml/yaml/blob/v3.0.1/LICENSE |
| `modernc.org/libc` | MIT | https://gitlab.com/cznic/libc/blob/v1.70.0/LICENSE-3RD-PARTY.md |
| `modernc.org/mathutil` | Unknown | Unknown |
| `modernc.org/memory` | BSD-3-Clause | https://gitlab.com/cznic/memory/blob/v1.11.0/LICENSE-GO |
| `modernc.org/sqlite` | BSD-3-Clause | https://gitlab.com/cznic/sqlite/blob/v1.48.1/LICENSE |

## Manually verified

The existing `go-licenses` scanner cannot load standard-library module metadata
with the current Go toolchain. The newly linked PDF dependencies below were
verified against their exact upstream license texts, retained in the Slides PDF
license directory; the preceding generated inventory is preserved.

| Package | License | Source URL |
|---------|---------|------------|
| `modernc.org/mathutil` | BSD-3-Clause | https://gitlab.com/cznic/mathutil |
| `github.com/signintech/gopdf` v0.38.3 | MIT | https://github.com/signintech/gopdf/blob/v0.38.3/LICENSE |
| `github.com/phpdave11/gofpdi` v1.0.14-0.20211212211723-1f10f9844311 | MIT | https://github.com/phpdave11/gofpdi/blob/1f10f9844311/LICENSE |

## Known accepted vulnerabilities

These vulnerabilities are tracked but cannot be fixed via dependency upgrade
because no upstream fix is available. They are accepted as known risk and
monitored for upstream resolution.

| CVE | Module | Status | Notes |
|-----|--------|--------|-------|
| GO-2026-5932 | golang.org/x/crypto/openpgp | No upstream fix (Fixed in: N/A) | The openpgp package is unmaintained and unsafe by design; upstream will never ship a fix (advisory is "use a maintained alternative"). **Not reachable in Crewship**: we never import `golang.org/x/crypto/openpgp` (it is a transitive-graph presence only — `go mod why golang.org/x/crypto` reports "main module does not need package"), and govulncheck lists it under "modules you require, but your code doesn't appear to call". Bumping x/crypto does not help — every published version, including the latest, still ships openpgp with the same advisory. Accepted as known, non-reachable risk. Monitor https://pkg.go.dev/vuln/GO-2026-5932 |

### Restricted native worker — bubblewrap

The restricted native image distributes Debian bubblewrap 0.8.0 with Debian's
`0.8.0-2+deb12u1` security patches and Crewship's atime-preserving remount patch.
The rebuilt Debian package is versioned `0.8.0-2+deb12u1+crewship1`.
Bubblewrap and the local derivative patch/header are LGPL-2.0-or-later; original
copyright and license texts remain in the package's `/usr/share/doc/bubblewrap/`.
The image also includes the complete modified corresponding source, Debian
build files and image build recipe as
`/usr/share/doc/bubblewrap/crewship-source.tar.xz`. The local patch and regression
source are in `cmd/crewship-restricted-native-runner/bubblewrap/`.
Upstream: https://github.com/containers/bubblewrap.