Licences of the services, packages and components

This page lists the SPDX licence of every catalog service, of every package or artifact a service installs and of every platform component, with the licence exceptions of the distribution. It is generated from navin-manager/catalog/services, catalog/components and catalog/licence-exceptions.yaml: do not edit by hand.

Licence policy

Component cores (a server, an operator, a chart, a CLI shipped to the client) are under MIT or Apache-2.0, the preferred licences. Internal code of the publisher is under LicenseRef-Navin-Enterprise.
Dependencies (libraries linked into a component or bundled in an image) may also be under these permissive licences, which need no exception: 0BSD, BSD-2-Clause, BSD-3-Clause, BSD-3-Clause-Clear, BlueOak-1.0.0, CC-BY-4.0, CC0-1.0, ISC, MIT-0, OFL-1.1, PSF-2.0, Python-2.0, Unicode-3.0, Unicode-DFS-2016, Unlicense, X11, Zlib, curl.
Every other licence needs an entry in catalog/licence-exceptions.yaml (identifier LEX-xxx) that states the justification, the scope, the obligations and the alternative.
Only the client approves an exception: the platform team writes every entry with the status pending; a release is blocked while a distributed component relies on an exception the client has not approved.

Decision: ADR-0101. Exact licences of PostgreSQL, Redis and the telephony bricks per version: third-party licences. Licences of the libraries of each artefact (SBOM): licence report.

Licence exceptions

Identifier	Name	SPDX	Components	Packages	Distribution	Approval
`LEX-001`	PostgreSQL	`PostgreSQL`	`postgresql`	`postgresql`	`provided_by_client`	pending, awaiting the client
`LEX-002`	Redis	`BSD-3-Clause (7.0.15: BSD-3-Clause; 7.2.17: BSD-3-Clause; 7.4.0: RSALv2 OR SSPL-1.0; 8.0.6: RSALv2 OR SSPL-1.0 OR AGPL-3.0-only)`	`redis`	-	`distributed`	pending, awaiting the client
`LEX-003`	MySQL (Opik state database)	`GPL-2.0-only`	`mysql`	-	`provided_by_client`	pending, awaiting the client
`LEX-004`	HAProxy	`GPL-2.0-or-later`	`haproxy`	-	`distributed`	pending, awaiting the client
`LEX-005`	Keepalived	`GPL-2.0-or-later`	`keepalived`	-	`distributed`	pending, awaiting the client
`LEX-006`	OpenBao	`MPL-2.0`	`openbao`	-	`distributed`	pending, awaiting the client
`LEX-007`	OpenTofu	`MPL-2.0`	`opentofu`	-	`provided_by_client`	pending, awaiting the client
`LEX-008`	Forgejo (CI runner and forge)	`GPL-3.0-or-later`	`forgejo`	-	`provided_by_client`	pending, awaiting the client
`LEX-009`	Wazuh (client SIEM connector)	`GPL-2.0-only`	`wazuh`	-	`provided_by_client`	pending, awaiting the client
`LEX-010`	FFmpeg and codecs	`LGPL-2.1-or-later AND GPL-2.0-or-later`	`ffmpeg`	-	`distributed`	pending, awaiting the client
`LEX-011`	NVIDIA drivers, CUDA and container toolkit	`LicenseRef-NVIDIA-Proprietary`	`nvidia-gpu-stack`	-	`provided_by_client`	pending, awaiting the client
`LEX-012`	Model weights	`LicenseRef-Model-Licences`	`model-weights`	-	`provided_by_client`	pending, awaiting the client
`LEX-013`	psycopg (PostgreSQL driver)	`LGPL-3.0-only`	`control-plane-api`, `navin-manager-server`	`psycopg`, `psycopg-binary`, `psycopg-pool`	`distributed`	pending, awaiting the client
`LEX-014`	certifi	`MPL-2.0`	`control-plane-api`, `navin-manager-server`	`certifi`	`distributed`	pending, awaiting the client
`LEX-015`	ldap3	`LGPL-3.0-only`	`navin-manager-server`	`ldap3`	`distributed`	pending, awaiting the client
`LEX-016`	sharp-libvips (Next.js image optimisation of the portal and of the RAG web application)	`LGPL-3.0-or-later`	`portal`, `navin-rag-web`	`@img/sharp-libvips-`, `@img/sharp-wasm32`, `@img/sharp-win32-`	`distributed`	pending, awaiting the client
`LEX-017`	tqdm and orjson (MPL-2.0 files)	`MPL-2.0`	`control-plane-api`, `sdk-python`	`tqdm`, `orjson`	`distributed`	pending, awaiting the client
`LEX-018`	pathspec	`MPL-2.0`	`sdk-python`	`pathspec`	`provided_by_client`	pending, awaiting the client
`LEX-019`	Semgrep Community Edition	`LGPL-2.1-only`	`semgrep`	-	`provided_by_client`	pending, awaiting the client
`LEX-020`	espeak-ng and phonemizer (Kokoro phonemisation)	`GPL-3.0-or-later`	`espeak-ng`	`phonemizer`, `phonemizer-fork`, `espeakng-loader`	`distributed`	pending, awaiting the client
`LEX-021`	regex (CNRI-Python part)	`Apache-2.0 AND CNRI-Python`	`control-plane-api`	`regex`	`distributed`	pending, awaiting the client
`LEX-022`	ClamAV	`GPL-2.0-only`	`clamav`	-	`distributed`	pending, awaiting the client
`LEX-023`	YARA-X	`BSD-3-Clause`	`yara-x`	`yara-x`	`distributed`	pending, awaiting the client
`LEX-024`	Asterisk	`GPL-2.0-only WITH Asterisk-linking-protocols-exception`	`asterisk`	-	`distributed`	pending, awaiting the client
`LEX-025`	Kamailio	`GPL-2.0-or-later`	`kamailio`	-	`distributed`	pending, awaiting the client
`LEX-026`	RTPengine	`GPL-3.0-or-later`	`rtpengine`	-	`distributed`	pending, awaiting the client
`LEX-027`	Asterisk sounds and music on hold	`CC-BY-SA-3.0`	`asterisk`	`asterisk-core-sounds-en`, `asterisk-moh-opsound-gsm`	`distributed`	pending, awaiting the client
`LEX-028`	PostgreSQL client and SQLite of the Asterisk nodes	`PostgreSQL AND blessing`	`asterisk`	`postgresql-client`, `sqlite3`	`distributed`	pending, awaiting the client
`LEX-029`	LiveKit local inference models (end of turn detector and streaming VAD)	`Apache-2.0 AND LicenseRef-LiveKit-Model`	`livekit-agents`	`livekit-local-inference`	`distributed`	pending, awaiting the client
`LEX-030`	FFmpeg libraries bundled in the PyAV wheel	`LGPL-3.0-or-later AND GPL-2.0-or-later`	`livekit-agents`	`ffmpeg`, `av`	`distributed`	pending, awaiting the client
`LEX-031`	Pillow	`MIT-CMU`	`livekit-agents`	`pillow`	`distributed`	pending, awaiting the client
`LEX-032`	Google Chrome in the LiveKit Egress image	`LicenseRef-Google-Chrome-Terms`	`livekit-egress`	`google-chrome-stable`	`distributed`	pending, awaiting the client
`LEX-033`	Media codecs in the LiveKit Ingress and Egress images	`FDK-AAC AND GPL-2.0-or-later`	`livekit-ingress`, `livekit-egress`	`libfdk-aac2`, `libx264-164`, `libx265-199`	`distributed`	pending, awaiting the client
`LEX-034`	LemonLDAP::NG	`GPL-2.0-or-later`	`lemonldap-ng`	-	`distributed`	pending, awaiting the client

Catalog services

Service	Version	Licence	Policy	Exception
Alertmanager	`0.28.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Grafana Alloy	`1.10.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Apache APISIX	`3.19.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Asterisk PBX	`20.6.0`	`GPL-2.0-only` WITH `Asterisk-linking-protocols-exception`	licence exception	LEX-024 (pending, awaiting the client)
Blackbox exporter	`0.27.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
ClamAV	`1.4.6`	`GPL-2.0-only`	licence exception	LEX-022 (pending, awaiting the client)
ClickHouse	`25.3.3.42`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Cognee	`1.6.6`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Docling Serve	`1.38.2`	`MIT`	core licence (MIT or Apache-2.0)	-
etcd	`3.5.35`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Falco	`0.45.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
garak	`0.12.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
HAProxy	`3.2.9`	`GPL-2.0-or-later`	licence exception	LEX-004 (pending, awaiting the client)
Haystack	`2.18.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Jaeger	`2.22.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Kamailio SIP edge	`5.7.4`	`GPL-2.0-or-later`	licence exception	LEX-025 (pending, awaiting the client)
keepalived	`2.4.3`	`GPL-2.0-or-later`	licence exception	LEX-005 (pending, awaiting the client)
Keycloak	`26.8.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Label Studio	`1.23.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
LemonLDAP::NG	`2.23.4`	`GPL-2.0-or-later`	licence exception	LEX-034 (pending, awaiting the client)
LiteLLM gateway	`1.106.5`	`MIT`	core licence (MIT or Apache-2.0)	-
LiveKit server	`1.13.11`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Voice agent workers	`1.0.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
LiveKit Egress	`1.15.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
LiveKit Ingress	`1.5.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
LiveKit SIP	`1.22.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
LLaMA-Factory	`0.9.5`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Marquez	`0.51.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
MCP hosting	`1.0.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Mem0	`2.2.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
MySQL Community Server	`8.4.5`	`GPL-2.0-only`	licence exception	LEX-003 (pending, awaiting the client)
NATS	`2.11.17`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Navin Enterprise	`1.0.0`	`LicenseRef-Navin-Enterprise`	licence of the publisher	-
Navin SM	`2.4.6`	`LicenseRef-Navin-Enterprise`	licence of the publisher	-
Node exporter	`1.9.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Ollama	`0.40.14`	`MIT`	core licence (MIT or Apache-2.0)	-
Open Policy Agent	`1.21.4`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
OpenBao	`2.7.2`	`MPL-2.0`	licence exception	LEX-006 (pending, awaiting the client)
OpenFGA	`1.22.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
OpenLineage SDK	`1.55.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
OpenSearch	`2.19.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
OpenSearch Dashboards	`2.19.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Opik	`1.8.16`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
OpenTelemetry Collector	`0.130.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
PostgreSQL exporter	`0.17.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
PostgreSQL	`16.15`	`PostgreSQL`	licence exception	LEX-001 (pending, awaiting the client)
Presidio	`2.2.366`	`MIT`	core licence (MIT or Apache-2.0)	-
Prometheus	`3.5.5`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
promptfoo	`0.117.4`	`MIT`	core licence (MIT or Apache-2.0)	-
Qdrant	`1.14.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Ragas	`0.3.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Redis Open Source	`7.2.17`	`BSD-3-Clause`	licence exception	LEX-002 (pending, awaiting the client)
Redis exporter	`1.75.0`	`MIT`	core licence (MIT or Apache-2.0)	-
RTPengine media relay	`11.5.1.18`	`GPL-3.0-or-later`	licence exception	LEX-026 (pending, awaiting the client)
SeaweedFS object storage	`4.51`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
SPIRE	`1.15.5`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Temporal	`1.27.4`	`MIT`	core licence (MIT or Apache-2.0)	-
Temporal Web UI	`2.57.0`	`MIT`	core licence (MIT or Apache-2.0)	-
Tetragon	`1.8.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
Tink	`1.16.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
vLLM	`0.33.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	-
YARA-X	`1.22.1`	`BSD-3-Clause`	licence exception	LEX-023 (pending, awaiting the client)

Packages and artifacts of the services

A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.

Service	Kind	Package	Version	Licence	Policy	Licence source
`alertmanager`	binary archive	`alertmanager-0.28.1.linux-amd64.tar.gz`	`0.28.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`alloy`	binary archive	`alloy-linux-amd64.zip`	`1.10.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`apisix`	container image	`docker.io/apache/apisix`	`3.19.0-debian`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`apisix`	OS package (RHEL family (dnf))	`apisix`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`apisix`	OS package (Debian family (apt))	`apisix`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`asterisk`	OS package (Debian family (apt))	`asterisk`	version of the configured repository	`GPL-2.0-only` WITH `Asterisk-linking-protocols-exception`	licence exception	licence of the service
`asterisk`	OS package (Debian family (apt))	`asterisk-modules`	version of the configured repository	`GPL-2.0-only` WITH `Asterisk-linking-protocols-exception`	licence exception	licence of the service
`asterisk`	OS package (Debian family (apt))	`asterisk-config`	version of the configured repository	`GPL-2.0-only` WITH `Asterisk-linking-protocols-exception`	licence exception	licence of the service
`asterisk`	OS package (Debian family (apt))	`asterisk-core-sounds-en`	version of the configured repository	`CC-BY-SA-3.0`	licence exception	https://downloads.asterisk.org/pub/telephony/sounds/
`asterisk`	OS package (Debian family (apt))	`asterisk-moh-opsound-gsm`	version of the configured repository	`CC-BY-SA-3.0`	licence exception	https://downloads.asterisk.org/pub/telephony/sounds/
`asterisk`	OS package (Debian family (apt))	`postgresql-client`	version of the configured repository	`PostgreSQL`	licence exception	https://www.postgresql.org/about/licence/
`asterisk`	OS package (Debian family (apt))	`sqlite3`	version of the configured repository	`blessing`	licence exception	https://sqlite.org/copyright.html
`blackbox-exporter`	binary archive	`blackbox_exporter-0.27.0.linux-amd64.tar.gz`	`0.27.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`clamav`	container image	`docker.io/clamav/clamav`	`1.4.6`	`GPL-2.0-only`	licence exception	licence of the service
`clamav`	container image	`docker.io/library/python`	`3.12.12-alpine3.22`	`PSF-2.0`	permissive licence of a dependency	https://docs.python.org/3/license.html
`clickhouse`	container image	`docker.io/clickhouse/clickhouse-server`	`25.3.3.42`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`clickhouse`	OS package (RHEL family (dnf))	`clickhouse-server`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`clickhouse`	OS package (RHEL family (dnf))	`clickhouse-client`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`clickhouse`	OS package (RHEL family (dnf))	`clickhouse-common-static`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`clickhouse`	OS package (Debian family (apt))	`clickhouse-server`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`clickhouse`	OS package (Debian family (apt))	`clickhouse-client`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`clickhouse`	OS package (Debian family (apt))	`clickhouse-common-static`	version of the configured repository	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	container image	`docker.io/cognee/cognee`	`1.6.6`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	container image	`docker.io/cognee/cognee-ui`	`1.6.6`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	container image	`docker.io/cognee/cognee-mcp`	`main-df2b4fa`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`cognee[api,postgres-binary,tracing]`	`1.6.6`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`ladybug`	`0.19.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`gunicorn`	`23.0.0`	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/gunicorn/
`cognee`	Python package	`uvicorn`	`0.53.0`	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/uvicorn/
`cognee`	Python package	`fastapi`	`0.141.1`	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/fastapi/
`cognee`	Python package	`fastapi-users`	`15.0.5`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`litellm`	`1.105.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`openai`	`2.54.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`sqlalchemy`	`2.0.54`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`alembic`	`1.20.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`asyncpg`	`0.31.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`psycopg2-binary`	`2.9.13`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`pgvector`	`0.3.6`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`opentelemetry-sdk`	`1.44.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`opentelemetry-exporter-otlp-proto-http`	`1.44.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/opentelemetry-exporter-otlp-proto-http/
`cognee`	Python package	`langdetect`	`1.0.9`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`cognee`	Python package	`pixeltable-pgserver`	`0.7.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`docling`	container image	`quay.io/docling-project/docling-serve-cpu`	`v1.38.2`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`docling`	Python package	`docling-serve`	`1.38.2`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`etcd`	container image	`quay.io/coreos/etcd`	`v3.5.35`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`etcd`	binary archive	`etcd-v3.5.35-linux-amd64.tar.gz`	`3.5.35`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`falco`	container image	`docker.io/falcosecurity/falco`	`0.45.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`falco`	binary archive	`falco-0.45.2-x86_64.tar.gz`	`0.45.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`garak`	Python package	`garak`	`0.12.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`haproxy`	container image	`docker.io/library/haproxy`	`3.2.9`	`GPL-2.0-or-later`	licence exception	licence of the service
`haproxy`	OS package (RHEL family (dnf))	`haproxy`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`haproxy`	OS package (Debian family (apt))	`haproxy`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`haystack`	developer package	`haystack-ai`	`2.18.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`jaeger`	container image	`docker.io/jaegertracing/jaeger`	`2.22.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`jaeger`	binary archive	`jaeger-2.22.0-linux-amd64.tar.gz`	`2.22.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`kamailio`	OS package (Debian family (apt))	`kamailio`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`kamailio`	OS package (Debian family (apt))	`kamailio-autheph-modules`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`kamailio`	OS package (Debian family (apt))	`kamailio-tls-modules`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`kamailio`	OS package (Debian family (apt))	`kamailio-websocket-modules`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`kamailio`	OS package (Debian family (apt))	`python3`	version of the configured repository	`PSF-2.0`	permissive licence of a dependency	https://docs.python.org/3/license.html
`keepalived`	OS package (RHEL family (dnf))	`keepalived`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`keepalived`	OS package (RHEL family (dnf))	`curl`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`keepalived`	OS package (Debian family (apt))	`keepalived`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`keepalived`	OS package (Debian family (apt))	`curl`	version of the configured repository	`GPL-2.0-or-later`	licence exception	licence of the service
`keycloak`	container image	`quay.io/keycloak/keycloak`	`26.8.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`keycloak`	binary archive	`keycloak-26.8.1.tar.gz`	`26.8.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`keycloak`	OS package (RHEL family (dnf))	`java-21-openjdk-headless`	version of the configured repository	`GPL-2.0-only` WITH `Classpath-exception-2.0`	outside the policy, no exception	https://openjdk.org/legal/gplv2+ce.html
`keycloak`	OS package (Debian family (apt))	`openjdk-21-jre-headless`	version of the configured repository	`GPL-2.0-only` WITH `Classpath-exception-2.0`	outside the policy, no exception	https://openjdk.org/legal/gplv2+ce.html
`label-studio`	container image	`docker.io/heartexlabs/label-studio`	`1.23.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`lemonldap-ng`	container image	`docker.io/lemonldapng/lemonldap-ng`	`2.23.4`	`GPL-2.0-or-later`	licence exception	licence of the service
`litellm`	Python package	`litellm`	`1.106.5`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`litellm`	Python package	`gunicorn`	`>=23.0.0,<24.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/gunicorn/
`litellm`	Python package	`uvicorn`	`>=0.33.0,<1.0` (range)	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/uvicorn/
`litellm`	Python package	`granian`	`>=2.7.4,<3.0` (range)	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/granian/
`litellm`	Python package	`uvloop`	`>=0.22.1,<1.0` (range)	`MIT` OR `Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/uvloop/
`litellm`	Python package	`fastapi`	`>=0.136.3,<1.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/fastapi/
`litellm`	Python package	`starlette`	`>=1.0.1,<2.0` (range)	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/starlette/
`litellm`	Python package	`backoff`	`>=2.2.1,<3.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/backoff/
`litellm`	Python package	`pyyaml`	`>=6.0.3,<7.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/PyYAML/
`litellm`	Python package	`rq`	`>=2.7.0,<3.0` (range)	`BSD-2-Clause`	permissive licence of a dependency	https://pypi.org/project/rq/
`litellm`	Python package	`orjson`	`>=3.11.6,<4.0` (range)	`MPL-2.0` AND (`Apache-2.0` OR `MIT`)	licence exception	https://pypi.org/project/orjson/
`litellm`	Python package	`hiredis`	`>=3.0.0,<4.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/hiredis/
`litellm`	Python package	`apscheduler`	`>=3.11.2,<4.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/APScheduler/
`litellm`	Python package	`fastapi-sso`	`>=0.19.0,<1.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/fastapi-sso/
`litellm`	Python package	`pyjwt`	`>=2.13.0,<3.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/PyJWT/
`litellm`	Python package	`python-multipart`	`>=0.0.27,<1.0` (range)	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/python-multipart/
`litellm`	Python package	`cryptography`	`>=49.0.0,<51.0` (range)	`Apache-2.0` OR `BSD-3-Clause`	core licence (MIT or Apache-2.0)	https://pypi.org/project/cryptography/
`litellm`	Python package	`pynacl`	`>=1.6.2,<2.0` (range)	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/PyNaCl/
`litellm`	Python package	`websockets`	`>=15.0.1,<16.0` (range)	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/websockets/
`litellm`	Python package	`boto3`	`>=1.43.117,<2.0` (range)	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/boto3/
`litellm`	Python package	`azure-identity`	`>=1.25.2,<2.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/azure-identity/
`litellm`	Python package	`azure-storage-blob`	`>=12.28.0,<13.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/azure-storage-blob/
`litellm`	Python package	`mcp`	`>=2.2.0,<3` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/mcp/
`litellm`	Python package	`httpx2`	`>=2.5.0,<3` (range)	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/httpx2/
`litellm`	Python package	`pydantic`	`>=2.12.0,<3` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/pydantic/
`litellm`	Python package	`litellm-proxy-extras`	`0.4.108`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`litellm`	Python package	`restrictedpython`	`>=8.5,<9.0` (range)	`ZPL-2.1`	outside the policy, no exception	https://pypi.org/project/RestrictedPython/
`litellm`	Python package	`rich`	`>=13.9.4,<14.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/rich/
`litellm`	Python package	`inquirerpy`	`>=0.3.4,<1.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/inquirerpy/
`litellm`	Python package	`tomlkit`	`>=0.13.3,<1.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/tomlkit/
`litellm`	Python package	`polars`	`>=1.38.1,<2.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/polars/
`litellm`	Python package	`soundfile`	`>=0.12.1,<1.0` (range)	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/soundfile/
`litellm`	Python package	`pyroscope-io`	`>=0.8.16,<1.0` (range)	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/pyroscope-io/
`litellm`	Python package	`expression`	`>=5.6.0,<6.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/Expression/
`litellm`	Python package	`prisma`	`>=0.11` (range)	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/prisma/
`litellm`	Python package	`opik`	`>=1.0` (range)	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/opik/
`litellm`	Python package	`opentelemetry-exporter-otlp-proto-http`	`>=1.25` (range)	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/opentelemetry-exporter-otlp-proto-http/
`litellm`	Python package	`prometheus_client`	`>=0.20,<1.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`livekit`	container image	`docker.io/livekit/livekit-server`	`v1.13.11`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`livekit`	binary archive	`livekit_1.13.11_linux_amd64.tar.gz`	`1.13.11`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`livekit-agents`	Python package	`navin-voice-agent`	`1.0.0`	`LicenseRef-Navin-Enterprise`	licence of the publisher	`services/voice-agent/pyproject.toml`
`livekit-agents`	Python package	`livekit-agents`	`1.8.10`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/livekit-agents/1.8.10/
`livekit-agents`	Python package	`livekit-plugins-openai`	`1.8.10`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/livekit-plugins-openai/1.8.10/
`livekit-agents`	Python package	`livekit-plugins-silero`	`1.8.10`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/livekit-plugins-silero/1.8.10/
`livekit-egress`	container image	`docker.io/livekit/egress`	`v1.15.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`livekit-ingress`	container image	`docker.io/livekit/ingress`	`v1.5.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`livekit-sip`	container image	`docker.io/livekit/sip`	`v1.22.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`llama-factory`	container image	`docker.io/hiyouga/llamafactory`	`0.9.5`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`marquez`	container image	`docker.io/marquezproject/marquez`	`0.51.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`marquez`	container image	`docker.io/marquezproject/marquez-web`	`0.51.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mcp-host`	container image	`docker.io/library/node`	`22.23.4-bookworm-slim`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mcp-host`	container image	`docker.io/astral/uv`	`0.9.30-python3.12-bookworm-slim`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mcp-host`	Python package	`navin-mcp-host`	`1.0.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`mem0ai`	`2.2.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`fastapi`	`0.115.8`	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/fastapi/
`mem0`	Python package	`uvicorn`	`0.34.0`	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/uvicorn/
`mem0`	Python package	`pydantic[email]`	`2.10.4`	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/pydantic/
`mem0`	Python package	`python-dotenv`	`1.2.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`psycopg[binary]`	`3.3.7`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`psycopg-pool`	`3.3.3`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`sqlalchemy`	`2.1.6`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`alembic`	`1.20.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`passlib[bcrypt]`	`1.7.4`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`bcrypt`	`4.0.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`python-jose[cryptography]`	`3.5.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`cryptography`	`50.0.2`	`Apache-2.0` OR `BSD-3-Clause`	core licence (MIT or Apache-2.0)	https://pypi.org/project/cryptography/
`mem0`	Python package	`posthog`	`7.82.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`slowapi`	`0.1.10`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`openai`	`3.42.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mem0`	Python package	`pixeltable-pgserver`	`0.7.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`mysql`	container image	`docker.io/library/mysql`	`8.4.5`	`GPL-2.0-only`	licence exception	licence of the service
`mysql`	OS package (RHEL family (dnf))	`mysql-community-server`	version of the configured repository	`GPL-2.0-only`	licence exception	licence of the service
`mysql`	OS package (RHEL family (dnf))	`mysql-community-client`	version of the configured repository	`GPL-2.0-only`	licence exception	licence of the service
`mysql`	OS package (Debian family (apt))	`mysql-server`	version of the configured repository	`GPL-2.0-only`	licence exception	licence of the service
`mysql`	OS package (Debian family (apt))	`mysql-client`	version of the configured repository	`GPL-2.0-only`	licence exception	licence of the service
`nats`	container image	`docker.io/library/nats`	`2.11.17`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`nats`	binary archive	`nats-server-v2.11.17-linux-amd64.tar.gz`	`2.11.17`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`navin-enterprise`	container image	`harbor.example.internal/eai/control-plane`	`1.0.0`	`LicenseRef-Navin-Enterprise`	licence of the publisher	licence of the service
`navin-enterprise`	container image	`harbor.example.internal/eai/worker`	`1.0.0`	`LicenseRef-Navin-Enterprise`	licence of the publisher	licence of the service
`navin-enterprise`	container image	`harbor.example.internal/eai/portal`	`1.0.0`	`LicenseRef-Navin-Enterprise`	licence of the publisher	licence of the service
`navin-enterprise`	Python package	`eai`	`1.0.0`	`LicenseRef-Navin-Enterprise`	licence of the publisher	`catalog/components/control-plane-api.yaml`
`navin-enterprise`	Python package	`ragas`	`0.3.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/ragas/0.3.2/
`navin-enterprise`	Python package	`langchain-openai`	`0.3.28`	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/langchain-openai/0.3.28/
`navin-enterprise`	Python package	`datasets`	`4.0.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/datasets/4.0.0/
`node-exporter`	binary archive	`node_exporter-1.9.1.linux-amd64.tar.gz`	`1.9.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`ollama`	container image	`docker.io/ollama/ollama`	`0.40.14`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`ollama`	container image	`docker.io/nginxinc/nginx-unprivileged`	`1.30.6-alpine-slim`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`opa`	container image	`docker.io/openpolicyagent/opa`	`1.21.4-static`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opa`	binary archive	`opa`	`1.21.4`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`openbao`	binary archive	`openbao_2.7.2_linux_amd64.tar.gz`	`2.7.2`	`MPL-2.0`	licence exception	licence of the service
`openfga`	container image	`docker.io/openfga/openfga`	`v1.22.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`openfga`	binary archive	`openfga_1.22.1_linux_amd64.tar.gz`	`1.22.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`openlineage`	developer package	`openlineage-python`	`1.55.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opensearch`	container image	`docker.io/opensearchproject/opensearch`	`2.19.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opensearch`	binary archive	`opensearch-2.19.2-linux-x64.tar.gz`	`2.19.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opensearch-dashboards`	container image	`docker.io/opensearchproject/opensearch-dashboards`	`2.19.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opensearch-dashboards`	binary archive	`opensearch-dashboards-2.19.2-linux-x64.tar.gz`	`2.19.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opik`	container image	`ghcr.io/comet-ml/opik/opik-backend`	`1.8.16`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opik`	container image	`ghcr.io/comet-ml/opik/opik-python-backend`	`1.8.16`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`opik`	container image	`ghcr.io/comet-ml/opik/opik-frontend`	`1.8.16`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`otel-collector`	container image	`docker.io/otel/opentelemetry-collector-contrib`	`0.130.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`otel-collector`	binary archive	`otelcol-contrib_0.130.0_linux_amd64.tar.gz`	`0.130.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`postgres-exporter`	binary archive	`postgres_exporter-0.17.1.linux-amd64.tar.gz`	`0.17.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`postgresql`	container image	`docker.io/pgvector/pgvector`	`0.8.7-pg16-bookworm`	`PostgreSQL`	licence exception	licence of the service
`postgresql`	Python package	`pixeltable-pgserver`	`0.7.1`	`PostgreSQL`	licence exception	licence of the service
`postgresql`	Python package	`patroni[etcd3]`	`4.1.5`	`PostgreSQL`	licence exception	licence of the service
`postgresql`	Python package	`psycopg[binary]`	`3.3.2`	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (RHEL family (dnf))	`postgresql16-server`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (RHEL family (dnf))	`postgresql16`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (RHEL family (dnf))	`postgresql16-contrib`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (RHEL family (dnf))	`pgvector_16`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (RHEL family (dnf))	`patroni`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (RHEL family (dnf))	`patroni-etcd`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (Debian family (apt))	`postgresql-16`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (Debian family (apt))	`postgresql-client-16`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (Debian family (apt))	`postgresql-16-pgvector`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (Debian family (apt))	`patroni`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`postgresql`	OS package (Debian family (apt))	`python3-etcd`	version of the configured repository	`PostgreSQL`	licence exception	licence of the service
`presidio`	container image	`mcr.microsoft.com/presidio-analyzer`	`2.2.362`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`presidio`	container image	`mcr.microsoft.com/presidio-anonymizer`	`2.2.362`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`presidio`	Python package	`presidio-analyzer`	`2.2.366`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`presidio`	Python package	`presidio-anonymizer`	`2.2.366`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`presidio`	Python package	`spacy`	`>=3.7,<4` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/spacy/
`presidio`	Python package	`en_core_web_lg`	`3.8.0`	`MIT`	core licence (MIT or Apache-2.0)	https://github.com/explosion/spacy-models/blob/master/meta/en_core_web_lg-3.8.0.json
`presidio`	Python package	`fr_core_news_lg`	`3.8.0`	`LGPLLR`	outside the policy, no exception	https://github.com/explosion/spacy-models/blob/master/meta/fr_core_news_lg-3.8.0.json
`presidio`	Python package	`flask`	`>=3.0` (range)	`BSD-3-Clause`	permissive licence of a dependency	https://pypi.org/project/Flask/
`presidio`	Python package	`gunicorn`	`>=22.0` (range)	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/gunicorn/
`prometheus`	binary archive	`prometheus-3.5.5.linux-amd64.tar.gz`	`3.5.5`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`promptfoo`	container image	`ghcr.io/promptfoo/promptfoo`	`0.117.4`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`promptfoo`	binary archive	`promptfoo-0.117.4.tgz`	`0.117.4`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`qdrant`	container image	`docker.io/qdrant/qdrant`	`v1.14.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`qdrant`	binary archive	`qdrant-x86_64-unknown-linux-gnu.tar.gz`	`1.14.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`ragas`	Python package	`ragas`	`0.3.2`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/ragas/0.3.2/
`ragas`	Python package	`langchain-openai`	`0.3.28`	`MIT`	core licence (MIT or Apache-2.0)	https://pypi.org/project/langchain-openai/0.3.28/
`ragas`	Python package	`datasets`	`4.0.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	https://pypi.org/project/datasets/4.0.0/
`redis`	container image	`docker.io/library/redis`	`7.2.17`	`BSD-3-Clause`	licence exception	licence of the service
`redis`	OS package (RHEL family (dnf))	`redis`	version of the configured repository	to confirm	to confirm	LEX-002
`redis`	OS package (Debian family (apt))	`redis-server`	version of the configured repository	to confirm	to confirm	LEX-002
`redis`	OS package (Debian family (apt))	`redis-tools`	version of the configured repository	to confirm	to confirm	LEX-002
`redis-exporter`	binary archive	`redis_exporter-v1.75.0.linux-amd64.tar.gz`	`1.75.0`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`rtpengine`	OS package (Debian family (apt))	`rtpengine-daemon`	version of the configured repository	`GPL-3.0-or-later`	licence exception	licence of the service
`rtpengine`	OS package (Debian family (apt))	`rtpengine-utils`	version of the configured repository	`GPL-3.0-or-later`	licence exception	licence of the service
`seaweedfs`	container image	`docker.io/chrislusf/seaweedfs`	`4.51`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`seaweedfs`	binary archive	`seaweedfs-4.51-linux_amd64.tar.gz`	`4.51`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`spire`	binary archive	`spire-1.15.5-linux-amd64-musl.tar.gz`	`1.15.5`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`temporal`	container image	`docker.io/temporalio/server`	`1.27.4`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`temporal`	container image	`docker.io/temporalio/admin-tools`	`1.27.2-tctl-1.18.2-cli-1.3.0`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`temporal`	binary archive	`temporal_1.27.4_linux_amd64.tar.gz`	`1.27.4`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`temporal-ui`	container image	`docker.io/temporalio/ui`	`2.57.0`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`temporal-ui`	binary archive	`ui-server_2.57.0_linux_amd64.tar.gz`	`2.57.0`	`MIT`	core licence (MIT or Apache-2.0)	licence of the service
`tetragon`	container image	`quay.io/cilium/tetragon`	`v1.8.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`tetragon`	binary archive	`tetragon-v1.8.0-amd64.tar.gz`	`1.8.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`tink`	developer package	`tink`	`1.16.1`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`vllm`	container image	`docker.io/vllm/vllm-openai`	`v0.33.0`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`vllm`	container image	`docker.io/vllm/vllm-openai-cpu`	`v0.33.0-x86_64`	`Apache-2.0`	core licence (MIT or Apache-2.0)	licence of the service
`yara-x`	Python package	`yara-x`	`1.22.1`	`BSD-3-Clause`	licence exception	licence of the service

Platform components

Component	Version	Licence	Licence status	Exception
Alertmanager	`v0.34.2`	`Apache-2.0`	allowed	-
Grafana Alloy	`v1.21.3`	`Apache-2.0`	allowed	-
Apache APISIX	`3.19.0`	`Apache-2.0`	allowed	-
Argo CD	`v2.13.2`	`Apache-2.0`	allowed	-
Asterisk	`20.6.0`	`GPL-2.0-only` WITH `Asterisk-linking-protocols-exception`	exception	LEX-024 (pending, awaiting the client)
AWS CLI	`2.27.0`	`Apache-2.0`	allowed	-
Blackbox exporter	`0.27.0`	`Apache-2.0`	allowed	-
cert-manager	`v1.16.2`	`Apache-2.0`	allowed	-
Cilium	`1.16.5`	`Apache-2.0`	allowed	-
ClamAV (clamd, freshclam and HTTPS gateway)	`1.4.6`	`GPL-2.0-only`	exception	LEX-022 (pending, awaiting the client)
ClickHouse	`25.3.6.10034.altinitystable`	`Apache-2.0`	allowed	-
Altinity ClickHouse operator	`0.27.4`	`Apache-2.0`	allowed	-
Client vault (BYO)	`byo` (provided by the client)	`LicenseRef-Client-Provided`	allowed	-
CloudNativePG	`1.25.0`	`Apache-2.0`	allowed	-
Cognee API	`1.6.6`	`Apache-2.0`	allowed	-
Control plane API	`1.0.2`	`LicenseRef-Navin-Enterprise`	allowed	-
Control plane worker	`1.0.2`	`LicenseRef-Navin-Enterprise`	allowed	-
Coraza WAF (proxy-wasm) with OWASP CRS	`gateway-image` (inside the gateway image)	`Apache-2.0`	allowed	-
Cosign	`2.6.5`	`Apache-2.0`	allowed	-
Docling (docling-serve)	`1.38.2`	`MIT`	allowed	-
Elasticsearch	`absent` (not deployed)	`AGPL-3.0-only` OR `SSPL-1.0` OR `Elastic-2.0`	non compliant	-
espeak-ng and phonemizer	`separate-process` (separate process)	`GPL-3.0-or-later`	exception	LEX-020 (pending, awaiting the client)
etcd	`3.5.35`	`Apache-2.0`	allowed	-
External Secrets Operator	`v2.14.0`	`Apache-2.0`	allowed	-
Falco	`node-provided` (provided by the node)	`Apache-2.0`	allowed	-
faster-whisper	`1.2.1`	`MIT`	allowed	-
FFmpeg and codecs	`distribution-package` (package of the distribution)	`LGPL-2.1-or-later` AND `GPL-2.0-or-later`	exception	LEX-010 (pending, awaiting the client)
Forgejo (CI)	`byo` (provided by the client)	`GPL-3.0-or-later`	exception	LEX-008 (pending, awaiting the client)
garak	`0.12.0`	`Apache-2.0`	allowed	-
Gitea	`absent` (not deployed)	`MIT`	allowed	-
Gitleaks	`v8.21.2`	`MIT`	allowed	-
Grafana	`absent` (not deployed)	`AGPL-3.0-only`	non compliant	-
gVisor	`node-provided` (provided by the node)	`Apache-2.0`	allowed	-
HAProxy	`3.2.9`	`GPL-2.0-or-later`	exception	LEX-004 (pending, awaiting the client)
Harbor	`1.19.4`	`Apache-2.0`	allowed	-
Haystack	`2.18.1`	`Apache-2.0`	allowed	-
Helm	`v3.16.3`	`Apache-2.0`	allowed	-
Jaeger	`2.22.0`	`Apache-2.0`	allowed	-
Kamailio	`5.7.4`	`GPL-2.0-or-later`	exception	LEX-025 (pending, awaiting the client)
KEDA and HPA	`2.16.1`	`Apache-2.0`	allowed	-
Keepalived	`2.4.3`	`GPL-2.0-or-later`	exception	LEX-005 (pending, awaiting the client)
Keycloak	`26.8.1`	`Apache-2.0`	allowed	-
Kokoro (kokoro-onnx)	`0.6.1`	`MIT`	allowed	-
kube-state-metrics	`v2.20.0`	`Apache-2.0`	allowed	-
kubeconform	`v0.6.7`	`Apache-2.0`	allowed	-
Kubernetes	`byo` (provided by the client)	`Apache-2.0`	allowed	-
Kyverno	`v1.13.2`	`Apache-2.0`	allowed	-
Label Studio Community Edition	`1.23.2`	`Apache-2.0`	allowed	-
Langfuse	`absent` (not deployed)	`MIT` AND `LicenseRef-Langfuse-EE`	non compliant	-
LemonLDAP::NG	`2.23.4`	`GPL-2.0-or-later`	exception	LEX-034 (pending, awaiting the client)
LiteLLM Proxy OSS	`v1.106.5`	`MIT`	allowed	-
LiveKit Server	`v1.9.0`	`Apache-2.0`	allowed	-
LiveKit Agents workers (navin-voice-agent)	`1.0.0`	`Apache-2.0`	allowed	-
LiveKit Egress	`1.15.0`	`Apache-2.0`	allowed	-
LiveKit Ingress	`1.5.0`	`Apache-2.0`	allowed	-
LiveKit SIP	`1.22.0`	`Apache-2.0`	allowed	-
LLaMA-Factory	`0.9.5`	`Apache-2.0`	allowed	-
Grafana Loki	`absent` (not deployed)	`AGPL-3.0-only`	non compliant	-
MCP official SDKs	`absent` (not deployed)	`MIT`	allowed	-
Media worker	`1.0.0`	`LicenseRef-Navin-Enterprise`	allowed	-
Mem0 REST server	`2.2.1`	`Apache-2.0`	allowed	-
MinIO	`absent` (not deployed)	`AGPL-3.0-only`	non compliant	-
Model weights	`byo` (provided by the client)	`LicenseRef-Model-Licences`	exception	LEX-012 (pending, awaiting the client)
MySQL (Opik state)	`8.4.5`	`GPL-2.0-only`	exception	LEX-003 (pending, awaiting the client)
NATS JetStream	`2.15.1`	`Apache-2.0`	allowed	-
Prometheus NATS exporter	`0.20.2`	`Apache-2.0`	allowed	-
navin-manager node agent	`1.0.2`	`LicenseRef-Navin-Enterprise`	allowed	-
navin-manager console	`1.0.2`	`LicenseRef-Navin-Enterprise`	allowed	-
Platform Operator	`1.0.0`	`LicenseRef-Navin-Enterprise`	allowed	-
navin-manager server	`1.0.2`	`LicenseRef-Navin-Enterprise`	allowed	-
Navin MCP host	`1.0.0`	`Apache-2.0`	allowed	-
Navin Enterprise RAG Agent API	`0.1.0`	`LicenseRef-Navin-Enterprise`	allowed	-
Navin Enterprise RAG Agent web application	`0.1.0`	`LicenseRef-Navin-Enterprise`	allowed	-
Navin Enterprise RAG Agent worker	`0.1.0`	`LicenseRef-Navin-Enterprise`	allowed	-
Navin runtime	`1.0.2`	`LicenseRef-Navin-Enterprise`	allowed	-
Navin SM	`2.4.6`	`LicenseRef-Navin-Enterprise`	allowed	-
Prometheus node exporter	`v1.12.1`	`Apache-2.0`	allowed	-
NVIDIA GPU Operator, drivers and CUDA	`v24.9.1`	`Apache-2.0`	exception	LEX-011 (pending, awaiting the client)
Ollama	`0.40.14`	`MIT`	allowed	-
Open Policy Agent	`1.22.0`	`Apache-2.0`	allowed	-
OpenBao	`v2.7.2`	`MPL-2.0`	exception	LEX-006 (pending, awaiting the client)
OpenCV	`absent` (not deployed)	`Apache-2.0`	allowed	-
OpenFGA	`v1.22.1`	`Apache-2.0`	allowed	-
OpenLineage	`absent` (not deployed)	`Apache-2.0`	allowed	-
OpenSearch and Security Analytics	`3.9.0`	`Apache-2.0`	allowed	-
OpenSearch Dashboards	`2.19.2`	`Apache-2.0`	allowed	-
OpenTelemetry SDK (Python)	`>=1.25`	`Apache-2.0`	allowed	-
OpenTofu	`1.8.7`	`MPL-2.0`	exception	LEX-007 (pending, awaiting the client)
Opik	`2.2.137`	`Apache-2.0`	allowed	-
OpenTelemetry Collector (contrib)	`0.163.2`	`Apache-2.0`	allowed	-
PaddleOCR	`byo` (provided by the client)	`Apache-2.0`	allowed	-
Enterprise portal	`1.0.2`	`LicenseRef-Navin-Enterprise`	allowed	-
PostgreSQL exporter	`0.17.1`	`Apache-2.0`	allowed	-
PostgreSQL	`16.6`	`PostgreSQL`	exception	LEX-001 (pending, awaiting the client)
Microsoft Presidio	`2.2.366`	`MIT`	allowed	-
Prometheus	`v3.15.1`	`Apache-2.0`	allowed	-
Prometheus operator	`v0.94.2`	`Apache-2.0`	allowed	-
Promptfoo	`0.117.4`	`MIT`	allowed	-
Pulumi OSS	`absent` (not deployed)	`Apache-2.0`	allowed	-
pyannote.audio	`>=3.1`	`MIT`	allowed	-
Qdrant	`v1.20.0`	`Apache-2.0`	allowed	-
Ragas	`0.3.2`	`Apache-2.0`	allowed	-
Redis	`v7.2.17`	`BSD-3-Clause`	exception	LEX-002 (pending, awaiting the client)
Redis exporter	`v1.44.0`	`MIT`	allowed	-
Redis operator (OT-CONTAINER-KIT)	`v0.27.0`	`Apache-2.0`	allowed	-
RTPengine	`11.5.1.18`	`GPL-3.0-or-later`	exception	LEX-026 (pending, awaiting the client)
SeaweedFS	`4.51`	`Apache-2.0`	allowed	-
Semgrep CE	`1.99.0`	`LGPL-2.1-only`	exception	LEX-019 (pending, awaiting the client)
Silero VAD	`6.2.3`	`MIT`	allowed	-
SPIFFE/SPIRE	`1.15.5`	`Apache-2.0`	allowed	-
Client storage connector (BYO)	`byo` (provided by the client)	`LicenseRef-Client-Provided`	allowed	-
Syft	`1.55.0`	`Apache-2.0`	allowed	-
Tekton Pipelines	`v1.18.0`	`Apache-2.0`	allowed	-
Temporal	`1.32.0`	`MIT`	allowed	-
Temporal UI	`2.54.1`	`MIT`	allowed	-
Tetragon	`node-provided` (provided by the node)	`Apache-2.0`	allowed	-
Thanos sidecar	`v0.42.5`	`Apache-2.0`	allowed	-
Google Tink	`1.16.1`	`Apache-2.0`	allowed	-
ToolHive Kubernetes Operator (Stacklok)	`v0.59.0`	`Apache-2.0`	allowed	-
Trivy	`0.58.1`	`Apache-2.0`	allowed	-
Velero	`v1.15.0`	`Apache-2.0`	allowed	-
vLLM	`v0.33.0`	`Apache-2.0`	allowed	-
Wazuh (client SIEM connector)	`byo` (provided by the client)	`GPL-2.0-only`	exception	LEX-009 (pending, awaiting the client)
YARA-X (rule scanning worker)	`1.22.1`	`BSD-3-Clause`	exception	LEX-023 (pending, awaiting the client)
ZAP	`2.15.0`	`Apache-2.0`	allowed	-
Apache ZooKeeper	`3.9.4`	`Apache-2.0`	allowed	-

To confirm

Licences or versions the sources do not settle:

Item	Why
`redis`: `redis`	The OS package comes from the repository of the host, without a pinned version, and the Redis licence depends on the version (LEX-002: 7.2.x and earlier BSD-3-Clause, 7.4 RSALv2 or SSPL-1.0, 8.x adds AGPL-3.0-only).
`redis`: `redis-server`	The OS package comes from the repository of the host, without a pinned version, and the Redis licence depends on the version (LEX-002: 7.2.x and earlier BSD-3-Clause, 7.4 RSALv2 or SSPL-1.0, 8.x adds AGPL-3.0-only).
`redis`: `redis-tools`	The OS package comes from the repository of the host, without a pinned version, and the Redis licence depends on the version (LEX-002: 7.2.x and earlier BSD-3-Clause, 7.4 RSALv2 or SSPL-1.0, 8.x adds AGPL-3.0-only).

Outside the policy without an exception

Package licences that are neither MIT, Apache-2.0, a permissive licence of the policy nor covered by an exception: each needs an entry in catalog/licence-exceptions.yaml.

Service	Package	Licence
`keycloak`	`java-21-openjdk-headless`	`GPL-2.0-only` WITH `Classpath-exception-2.0`
`keycloak`	`openjdk-21-jre-headless`	`GPL-2.0-only` WITH `Classpath-exception-2.0`
`litellm`	`restrictedpython`	`ZPL-2.1`
`presidio`	`fr_core_news_lg`	`LGPLLR`

Licence policy​

Licence exceptions​

Catalog services​

Packages and artifacts of the services​

Platform components​

To confirm​

Outside the policy without an exception​