2.2 KiB
Third-party components and license notices
AssetManager is released under the Apache License 2.0. The following components are independent third-party projects and are governed by their respective licenses.
Directly used components
| Component | Use | Upstream license |
|---|---|---|
| FastAPI | Web framework | MIT |
| Uvicorn | ASGI server | BSD-3-Clause |
| SQLAlchemy | Database abstraction | MIT |
| Psycopg / psycopg-binary | PostgreSQL driver | LGPL-3.0-only |
| Jinja | HTML templates | BSD-3-Clause |
| python-multipart | Form and upload processing | Apache-2.0 |
| pydantic-settings | Environment-based configuration | MIT |
| itsdangerous | Signed session data | BSD-3-Clause |
| ldap3 | Optional LDAP integration | LGPL-3.0-or-later |
| Passlib | Password hashing | BSD-style license; includes additional notices for bundled components |
| bcrypt | Hashing library used by passlib[bcrypt] |
Apache-2.0 |
| openpyxl | Excel import and export | MIT |
| MeshCentral / MeshCtrl | Optional integration and remote jobs | Apache-2.0 |
| PostgreSQL container image | Database service | Contains PostgreSQL and operating-system packages under their own licenses |
| Python container image | Runtime base | Contains Python and operating-system packages under their own licenses |
Transitive dependencies
Extras such as uvicorn[standard], psycopg[binary], and passlib[bcrypt] install additional packages. Node.js packages may also bring transitive dependencies. The license texts of the versions actually built and distributed are authoritative.
The Docker build therefore runs tools/export_dependency_licenses.py. Discovered license, NOTICE, COPYING, and copyright files are collected under /app/THIRD_PARTY_LICENSES/ in the image. Preserve this directory when distributing a built image or offline package.
No transfer of third-party rights
Product names and trademarks belong to their respective owners. Their mention only describes technical use or integration and does not imply affiliation, endorsement, or certification.
Review when dependencies change
Review license terms and required notices whenever a dependency is added or updated. Automatically collected metadata does not replace review of the original license texts.