# Third-party components

EncodeHarbor calls FFmpeg/FFprobe as separate executables. The MIT license on this application's code does not replace the licenses on those programs or on their libraries.

- Python: PSF license. https://docs.python.org/3/license.html
- Flask and Werkzeug: BSD-3-Clause. https://github.com/pallets/flask and https://github.com/pallets/werkzeug
- Waitress: ZPL-2.1. https://github.com/Pylons/waitress
- FFmpeg: the Debian build includes GPL components, including libx264. Inspect the exact build with `ffmpeg -L` and `ffmpeg -buildconf`. https://ffmpeg.org/legal.html
- Debian packages: copyright and licensing notices are retained in `/usr/share/doc/*/copyright` in the image.
- gosu: Apache-2.0; tini: MIT. Their Debian package notices are included in the image.

The release workflow collects the exact Debian source packages matching the installed binaries before pushing the image. Each GitHub release includes `installed-packages.tsv`, an image SBOM, checksums and split `debian-sources.tar.part-*` archives. Reassemble them with:

```sh
sha256sum -c SHA256SUMS
cat debian-sources.tar.part-* | tar -xf -
```

The extracted packages include their source archives and Debian patches/build recipes. Sources are collected by `scripts/collect-sources.py` from the same tested image that is pushed to the registry. The image's Debian copyright notices remain in `/usr/share/doc`. The Dockerfile describes how the binaries and application are assembled.