Exact licences of PostgreSQL, Redis and the telephony bricks (legal notice)
This notice records, for every delivered or catalogued version, the exact licence of the two data bricks the
distribution uses without publishing them. It is checked by
services/control-plane/tests/test_architecture_decisions.py::test_postgresql_redis_legal_notice_matches_catalogs,
which compares it with the component catalogue (catalog/components), the Manager host catalogue
(navin-manager/catalog/services), the licence exceptions (catalog/licence-exceptions.yaml) and the SBOM of the
server bricks (release/sbom-servers/platform-servers.spdx.json).
| Brick | Version | Where | SPDX licence | Exception |
|---|---|---|---|---|
| PostgreSQL | 16.6 | provided by the client or CloudNativePG | PostgreSQL | LEX-001 |
| Redis | 7.2.17 | deploy/, deploy/compose/docker-compose.yml and Manager host catalogue | BSD-3-Clause | LEX-002 |
Obligations
- PostgreSQL: keep the copyright notice and the PostgreSQL licence text in the notices of any redistributed binary.
- Redis 7.2.17: keep the copyright notice and the BSD-3-Clause text. The 7.2 line is the last one under BSD-3-Clause (7.4 is RSALv2 or SSPL-1.0, Redis 8 adds AGPL-3.0-only): no AGPL option is retained (decision of 2026-11-05, finding P8-001).
packagemethod of the Redis catalogue: it installs the Redis of the distribution (packagesredis,redis-server), 7.x under BSD-3-Clause on RHEL 8/9 and Ubuntu 22.04/24.04; its version follows the host repository.
Client decision
Exception LEX-002 stays pending in catalog/licence-exceptions.yaml: only the client approves it. Since
2026-11-05, the reference profile, the compose stack and the Manager host catalogue use Redis 7.2.17 (BSD-3-Clause).
Moving to Redis 8 would require the approval of LEX-002 with the explicit choice of its licence.
History: until 2026-11-05, deploy/ and the compose stack pinned Redis 7.0.15 (BSD-3-Clause), and the Manager host
catalogue Redis Open Source 8.0.2 then 8.0.6 (RSALv2 OR SSPL-1.0 OR AGPL-3.0-only, AGPL-3.0-only option retained under
LEX-002).
Telephony bricks (ADR-0173)
The telephony bricks are installed by the Manager host catalogue and run as separate processes; no Navin code links
them. Their SBOM is release/sbom-servers/telephony-servers.spdx.json (versions of the catalogue, image digests and
licence relevant packages found by Syft 1.55.0 on 2026-11-03), checked by
services/control-plane/tests/test_architecture_decisions.py::test_telephony_legal_notice_matches_catalogs. Every
exception below is pending: only the client approves it.
| Brick | Version | Where | SPDX licence | Exception |
|---|---|---|---|---|
| Asterisk | 20.6.0 | Ubuntu 24.04 package, asterisk service | GPL-2.0-only WITH Asterisk-linking-protocols-exception | LEX-024 |
Asterisk sounds (asterisk-core-sounds-en) | 1.6.1 | Ubuntu 24.04 package, installed with Asterisk | CC-BY-SA-3.0 | LEX-027 |
Asterisk music on hold (asterisk-moh-opsound-gsm) | 2.03 | Ubuntu 24.04 package, installed with Asterisk | CC-BY-SA-3.0 | LEX-027 |
| Kamailio | 5.7.4 | Ubuntu 24.04 package (Debian 13: 6.0.1), kamailio service | GPL-2.0-or-later | LEX-025 |
| RTPengine (optional) | 11.5.1.18 | Ubuntu 24.04 package (Debian 13: 12.5.1.31), rtpengine service | GPL-3.0-or-later | LEX-026 |
| LiveKit server | 1.13.11 | release binary, livekit service | Apache-2.0 | - |
| LiveKit SIP | 1.22.0 | image docker.io/livekit/sip, livekit-sip service | Apache-2.0 | - |
| LiveKit Ingress | 1.5.0 | image docker.io/livekit/ingress, livekit-ingress service | Apache-2.0 | LEX-033 (image content) |
| LiveKit Egress | 1.15.0 | image docker.io/livekit/egress, livekit-egress service | Apache-2.0 | LEX-032, LEX-033 (image content) |
| Google Chrome (in the Egress image) | 154.0.8037.57-1 | docker.io/livekit/egress:v1.15.0 only | LicenseRef-Google-Chrome-Terms | LEX-032 |
FDK AAC (libfdk-aac2) | 2.0.2-3~ubuntu4 | Ingress and Egress images | FDK-AAC | LEX-033 |
x264 (libx264-164) | 2:0.164.3108+git31e19f9-1 | Ingress and Egress images | GPL-2.0-or-later | LEX-033 |
x265 (libx265-199) | 3.5-2build1 | Ingress and Egress images | GPL-2.0-or-later | LEX-033 |
The voice agent workers (livekit-agents service) are internal code (LicenseRef-Navin-Enterprise, package
navin-voice-agent) on the Apache-2.0 LiveKit Agents SDK. Their dependencies are in the component SBOM
release/sbom/voice-agent.spdx.json and in docs/implementation/en/LICENCES.md, with three exceptions: LEX-029
(livekit-local-inference, models under the LiveKit Model License), LEX-030 (FFmpeg bundled in the av wheel,
LGPL-3.0-or-later, with x264 and x265 under GPL-2.0-or-later) and LEX-031 (pillow, MIT-CMU).
Telephony obligations
- Asterisk: provide the corresponding source of the shipped binary on request (Ubuntu source package) and keep the notices. The exception of the Asterisk LICENSE allows linking with OpenSSL and states that AMI, AGI and ARI applications need not be under the GPL; the Control Plane only talks AMI and ARI over the network. The name and logos of Asterisk are trademarks of Sangoma (Digium).
- Asterisk sounds and music on hold: credit the authors (CREDITS files of the packages), keep the CC-BY-SA-3.0 licence with the files and share any modified prompt under the same licence. Prompts uploaded by a tenant replace them.
- PostgreSQL client and SQLite of the Asterisk nodes (LEX-028, PostgreSQL AND blessing): keep the PostgreSQL copyright notice and licence text; no copyleft.
- Kamailio and RTPengine: provide the corresponding source of the shipped binaries on request and keep the notices;
for RTPengine keep the OpenSSL linking exception of Sipwise (
debian/copyright), which has no SPDX identifier. - LiveKit server, SIP, Ingress and Egress: keep the Apache-2.0 licence and NOTICE files. The OS packages of the images keep their own licences.
- Google Chrome (LEX-032): proprietary software. Legal review before mirroring the Egress image into an offline bundle; the alternative is to pull the image on the site. Audio recordings of calls (track and participant egress) do not start Chrome.
- FDK AAC, x264 and x265 (LEX-033): source of the GPL libraries on request, FDK AAC licence kept with the images. The AAC, H.264 and HEVC patent licences stay with the operator of the recordings.
- Voice agent workers: LEX-029 limits the LiveKit models to use with LiveKit Agents and forbids training other models with them; LEX-030 requires a legal review of the GPL-2.0-or-later x264 and x265 libraries loaded in the process of the workers before any distribution (alternative: a PyAV wheel built against an LGPL only FFmpeg).