Licences of the programs the binary snippets come from
======================================================

The files under syft/pkg/cataloger/binary/testdata/classifiers/snippets/ are
byte fragments cut from released binaries, plus a header recording where each
was cut. The first path component names the program and the second its
version. This lists the licence of every program at those versions, read on
2026-11-04 from the licence file at the matching upstream tag, or from the
program's Debian package where there is no public tag. debian/copyright says
on what basis the fragments are shipped.

Programs under licences that are not free (28 files)
----------------------------------------------------

arangodb 3.12.0-2 3.12.5 3.12.5-2: BSL-1.1. Source: arangodb/arangodb LICENSE
  at v3.12.0, v3.12.5.
auditbeat 9.4.2: Elastic-2.0 for the default distribution; the repository is
  Apache-2.0 and Elastic-2.0. Source: elastic/beats LICENSE.txt at v9.4.2.
elastic-agent 8.11.2 8.19.4 9.0.0 9.4.2: Elastic-2.0. Source:
  elastic/elastic-agent LICENSE.txt at v8.11.2, v8.19.4, v9.0.0, v9.4.2.
filebeat 8.11.2 8.18.4 9.4.2: Elastic-2.0 for the default distribution; the
  repository is Apache-2.0 and Elastic-2.0. Source: elastic/beats LICENSE.txt
  at v8.11.2, v8.18.4, v9.4.2.
heartbeat 9.4.2: Elastic-2.0 for the default distribution; the repository is
  Apache-2.0 and Elastic-2.0. Source: elastic/beats LICENSE.txt at v9.4.2.
java-jdk-oracle 1.8.0_451-b10: Oracle's licence for its Java SE 8 binaries.
  Source: the fixture, which names an Oracle JDK build.
java-jre-oracle 1.8.0_451-b10: Oracle's licence for its Java SE 8 binaries.
  Source: the fixture, which names an Oracle JRE build.
java-jre-oracle-sdk 1.8.0_451-b10: Oracle's licence for its Java SE 8 binaries.
  Source: the fixture, which names an Oracle JDK build.
metricbeat 9.4.2: Elastic-2.0 for the default distribution; the repository is
  Apache-2.0 and Elastic-2.0. Source: elastic/beats LICENSE.txt at v9.4.2.
mongodb 4.4.30 5.0.32 6.0.27 7.0.28 8.0.17: SSPL-1.0. Source: mongodb/mongo
  LICENSE-Community.txt at r4.4.30, r5.0.32, r6.0.27, r7.0.28, r8.0.17.
packetbeat 9.4.2: Elastic-2.0 for the default distribution; the repository is
  Apache-2.0 and Elastic-2.0. Source: elastic/beats LICENSE.txt at v9.4.2.
vault 1.13.13 1.14.10 1.19.4 1.20.2 1.21.0-rc1: BSL-1.1. Source:
  hashicorp/vault LICENSE at v1.13.13, v1.14.10, v1.19.4, v1.20.2, v1.21.0-rc1.

Origin not recorded (2 files)
-----------------------------

chrome 126.0.6478.182 127.0.6533.119: claims Google Chrome; records no offset
  and no SHA-256 of an original, and its strings also occur in Chromium.
  Source: the files themselves.

Written by Anchore (14 files)
-----------------------------

go-version-hint 1.15 1.15-dev 1.15w 1.21 1.25 1.25w: written by Anchore, no
  third-party content. Source: the files themselves.
java-jre-oracle 19.0.1: written by Anchore, no third-party content. Source: the
  files themselves.

Free software (237 files)
-------------------------

arangodb 3.11.8: Apache-2.0. Source: arangodb/arangodb LICENSE at v3.11.8.
aws-lc 1.69.0: Apache-2.0 and ISC and OpenSSL. Source: aws/aws-lc LICENSE at
  v1.69.0.
bash 5.1.16: GPL-3+. Source: Debian bash 5.3-4.
bun 0.5.9 1.0.0 1.1.0 1.3.5: Expat, with LGPL-2 JavaScriptCore linked in.
  Source: oven-sh/bun LICENSE.md at bun-v1.3.5.
busybox 1.36.1: GPL-2. Source: Debian busybox 1:1.38.0-3.
consul 1.7.14 1.12.9 1.15.2: MPL-2.0. Source: hashicorp/consul LICENSE at
  v1.12.9, v1.15.2, v1.7.14.
dart 2.12.4 3.0.0 3.5.2 3.6.0-216.1.beta: BSD-3-Clause. Source: dart-lang/sdk
  LICENSE at 2.12.4, 3.0.0, 3.5.2, 3.6.0-216.1.beta.
deno 1.10.3 1.11.3 1.11.4 1.16.4 1.28.3 1.29.4 1.41.0 2.0.0 2.6.3 2.9.2: MIT.
  Source: denoland/deno LICENSE.md at v1.10.3, v1.11.3, v1.11.4, v1.16.4,
  v1.28.3, v1.29.4, v1.41.0, v2.0.0, v2.6.3, v2.9.2.
elixir 1.12.0-rc.1 1.19.1: Apache-2.0. Source: elixir-lang/elixir LICENSE at
  v1.12.0-rc.1, v1.19.1.
envoy 1.6.0 1.11.0 1.14.3 1.18.6 1.20.7 1.22.10 1.22.11 1.23.7 1.24.5 1.24.9
  1.28.7 1.30.1 1.30.2 1.30.6 1.31.2 1.34.5 1.34.12 1.35.4 1.36.1 1.36.4:
  Apache-2.0. Source: envoyproxy/envoy LICENSE at v1.11.0, v1.14.3, v1.18.6,
  v1.20.7, v1.22.10, v1.22.11, v1.23.7, v1.24.5, v1.24.9, v1.28.7, v1.30.1,
  v1.30.2, v1.30.6, v1.31.2, v1.34.12, v1.34.5, v1.35.4, v1.36.1, v1.36.4,
  v1.6.0.
erlang 17.5.6.9: ErlPL-1.1. Source: erlang/otp EPLICENCE at OTP-17.5.
erlang 25.3.2.6 26.1.2 26.2.0.0 26.2.4 27.0: Apache-2.0. Source: erlang/otp
  LICENSE.txt at OTP-25.3.2.6, OTP-26.1.2, OTP-26.2, OTP-26.2.4, OTP-27.0.
ffmpeg 6.1.1 7.1.1: LGPL-2.1+, GPL-2+ when built with GPL parts. Source:
  FFmpeg/FFmpeg LICENSE.md at n6.1.1, n7.1.1.
ffmpeg-shared-libs 5.1.4: LGPL-2.1+, GPL-2+ when built with GPL parts. Source:
  FFmpeg/FFmpeg LICENSE.md at n5.1.4.
firefox 151.0: MPL-2.0. Source: Debian firefox-esr 153.6.0esr-1.
fluent-bit 1.3.10 1.7.0-dev-3 2.2.1 3.0.2: Apache-2.0. Source:
  fluent/fluent-bit LICENSE at v1.3.10, v1.7.0, v2.2.1, v3.0.2.
gcc 12.3.0: GPL-3+. Source: Debian gcc-12 12.5.0-11.
go 1.21.3: BSD-3-clause. Source: golang/go LICENSE at go1.21.3.
grafana 9.0.0 9.2.13 9.2.20 9.3.0-beta1 9.4.0-beta1 9.5.21 10.3.12 10.4.19
  11.0.0 11.0.0-preview 11.0.5-security-01 12.0.0 12.0.0-security-01
  12.2.0-258092 12.3.1 12.3.2-security-01 12.4.0-22081664032
  12.4.3-security-02: AGPL-3.0. Source: grafana/grafana LICENSE at v10.3.12,
  v10.4.19, v11.0.0, v11.0.0-preview, v12.4.3, v12.0.0, v12.3.1, v9.0.0,
  v9.2.13, v9.2.20, v9.3.0-beta1, v9.4.0-beta1, v9.5.21.
grafana 6.0.0-beta1 6.7.0-test 6.7.6 7.5.17: Apache-2.0. Source:
  grafana/grafana LICENSE.md at v6.0.0-beta1; grafana/grafana LICENSE at
  v6.7.6, v7.5.17.
gzip 1.12: GPL-3+. Source: Debian gzip 1.14-1.
haproxy 1.5.14 1.8.22 2.0.0 2.7.3 3.1-dev0: GPL-2+ and LGPL-2.1. Source:
  haproxy/haproxy LICENSE at v2.0.0, v3.1-dev0.
haskell-cabal 1.22.6.0 3.10.3.0: BSD-3-clause. Source: haskell/cabal LICENSE at
  Cabal-v1.22.6.0, Cabal-v3.10.3.0.
haskell-ghc 7.10.3 8.10.4 9.6.5: GHC licence, BSD-3-clause style. Source:
  ghc/ghc LICENSE at ghc-7.10.3-release, ghc-8.10.4-release, ghc-9.6.5-release.
heimdal-krb5 7.8.0: BSD-3-clause. Source: heimdal/heimdal LICENSE at
  heimdal-7.8.0.
helm 2.0.0-beta.2 2.17.0-rc.1 3.0.0-alpha.1 3.10.3 3.11.1 3.12.0 3.15.2 4.1.4:
  Apache-2.0. Source: helm/helm LICENSE at v2.0.0-beta.2, v2.17.0-rc.1,
  v3.0.0-alpha.1, v3.10.3, v3.11.1, v3.12.0, v3.15.2, v4.1.4.
httpd 2.4.54: Apache-2.0. Source: apache/httpd LICENSE at 2.4.54.
istio_pilot-agent 1.1.17 1.8.0 1.10-dev 1.26.8 1.29.0-alpha.0 1.29.0-beta.0
  1.29.0-rc.3: Apache-2.0. Source: istio/istio LICENSE at 1.1.17, 1.10.0,
  1.26.8, 1.29.0-alpha.0, 1.29.0-beta.0, 1.29.0-rc.3, 1.8.0.
istio_pilot-discovery 1.1.17 1.3.8 1.8.0 1.10-dev 1.26.8 1.29.0-alpha.0
  1.29.0-beta.0 1.29.0-rc.3: Apache-2.0. Source: istio/istio LICENSE at 1.1.17,
  1.10.0, 1.26.8, 1.29.0-alpha.0, 1.29.0-beta.0, 1.29.0-rc.3, 1.3.8, 1.8.0.
java-graal-openjdk 17.0.3+7-jvmci-22.1-b06: GPL-2 with Classpath exception.
  Source: graalvm/graal-jvmci-8 LICENSE.
java-jdk-openjdk 21.0.2+13-LTS: GPL-2 with Classpath exception. Source: Debian
  openjdk-21.
java-jre-openjdk 1.8.0_352-b08 11.0.17: GPL-2 with Classpath exception. Source:
  Debian openjdk-21.
java-jre-openjdk-arm64-eclipse 11.0.22: GPL-2 with Classpath exception. Source:
  Debian openjdk-21.
java-jre-openjdk-eclipse 11.0.22: GPL-2 with Classpath exception. Source:
  Debian openjdk-21.
jq 1.7.1: Expat. Source: jqlang/jq COPYING at jq-1.7.1.
julia 1.8.5 1.9.0-alpha1 1.10.11 1.11.9 1.12.6 1.13.0-alpha2 1.13.0-beta3: MIT.
  Source: JuliaLang/julia LICENSE.md at v1.10.11, v1.11.9, v1.12.6,
  v1.13.0-alpha2, v1.13.0-beta3, v1.8.5, v1.9.0-alpha1.
krb5 1.17 1.18.4: MIT Kerberos licence. Source: Debian krb5 1.22.1-3.
lighttpd 1.4.76: BSD-3-Clause. Source: lighttpd/lighttpd1.4 COPYING at
  lighttpd-1.4.76.
mariadb 10.6.15 11.8.5: GPL-2.0. Source: MariaDB/server COPYING at
  mariadb-10.6.15, mariadb-11.8.5.
memcached 1.6.18: BSD-3-clause. Source: memcached/memcached LICENSE at 1.6.18.
mysql 5.6.51 8.0.34 8.0.37: GPL-2 (MySQL Community). Source: mysql/mysql-server
  LICENSE at mysql-5.6.51, mysql-8.0.34, mysql-8.0.37.
mysql-cluster 7.6.17 9.7.0: GPL-2 (MySQL Community). Source: mysql/mysql-server
  LICENSE at mysql-cluster-7.6.17, mysql-cluster-9.7.0.
mysqld 9.7.0: GPL-2 (MySQL Community). Source: mysql/mysql-server LICENSE at
  mysql-cluster-9.7.0.
ndb_mgmd 9.7.0: GPL-2 (MySQL Community). Source: mysql/mysql-server LICENSE at
  mysql-cluster-9.7.0.
ndbd 9.7.0: GPL-2 (MySQL Community). Source: mysql/mysql-server LICENSE at
  mysql-cluster-9.7.0.
ndbmtd 9.7.0: GPL-2 (MySQL Community). Source: mysql/mysql-server LICENSE at
  mysql-cluster-9.7.0.
nginx 1.25.1: BSD-2-clause. Source: nginx/nginx LICENSE.
nginx-ingress-controller 0.33.0 0.34.0 1.0.0-alpha.2 1.2.0-beta.1 1.7.1 1.9.6
  1.11.8 1.12.0-beta.0 1.15.1: Apache-2.0. Source: kubernetes/ingress-nginx,
  every other tag; kubernetes/ingress-nginx LICENSE at controller-v0.34.0,
  controller-v1.0.0-alpha.2, controller-v1.11.8, controller-v1.12.0-beta.0,
  controller-v1.15.1, controller-v1.2.0-beta.1, controller-v1.7.1,
  controller-v1.9.6.
nginx-openresty 1.21.4.3: BSD-2-clause. Source: openresty/openresty COPYRIGHT
  at v1.21.4.3.
node 0.10.48 0.12.18 4.9.1 19.2.0: Expat. Source: nodejs/node LICENSE at
  v0.10.48, v0.12.18, v19.2.0, v4.9.1.
openldap 2.6.10: OLDAP-2.8. Source: openldap/openldap LICENSE at
  OPENLDAP_REL_ENG_2_6_10.
openssl 1.1.1w 1.1.1zb: OpenSSL and SSLeay. Source: openssl/openssl LICENSE at
  OpenSSL_1_1_1w; openssl/openssl OpenSSL_1_1_1w LICENSE (1.1.1zb has no public
  tag).
openssl 3.1.4: Apache-2.0. Source: openssl/openssl LICENSE.txt at
  openssl-3.1.4.
percona-server 8.0.35: GPL-2 (MySQL Community). Source: percona/percona-server
  LICENSE at Percona-Server-8.0.35-27.
percona-xtrabackup 8.0.35: GPL-2 (MySQL Community). Source:
  percona/percona-xtrabackup LICENSE at percona-xtrabackup-8.0.35-30.
percona-xtradb-cluster 8.0.34: GPL-2 (MySQL Community). Source:
  percona/percona-xtradb-cluster LICENSE at 8.0.
perl 5.12.5 5.20.0 5.37.8: GPL-1+ or Artistic. Source: Perl/perl5 Copying at
  v5.12.5, v5.20.0, v5.37.8.
php-apache 8.2.1: PHP-3.01. Source: php/php-src LICENSE at php-8.2.1.
postgres 9.5alpha1 9.6.24 15.1 15beta4: PostgreSQL. Source: postgres/postgres
  COPYRIGHT at REL_15_1, REL_15_BETA4, REL9_6_24.
proftpd 1.3.8b: GPL-2.0. Source: proftpd/proftpd COPYING at v1.3.8b.
pypy-shared-lib 7.3.14: Expat. Source: pypy/pypy LICENSE at
  release-pypy3.10-v7.3.14.
python 3.6.3: PSF-2. Source: python/cpython LICENSE at v3.6.3.
python-duplicates 3.8.16: PSF-2. Source: python/cpython LICENSE at v3.8.16.
python-shared-lib 3.7.4: PSF-2. Source: python/cpython LICENSE at v3.7.4.
python-with-incorrect-match 3.5.3: PSF-2. Source: python/cpython LICENSE at
  v3.5.3.
qt 4.8.6 5.15.2 6.5.0: LGPL-2.1 with Qt exception or GPL-3 (4.8); LGPL-3 or
  GPL-2 (5.15, 6.5). Source: Debian qt4-x11, qtbase-opensource-src, qt6-base.
redis-server 2.8.23 4.0.11 5.0.0 6.0.16 7.0.0 7.0.14 7.2.3 7.2.5: BSD-3-Clause.
  Source: redis/redis COPYING at 2.8.23, 4.0.11, 5.0.0, 6.0.16, 7.0.0, 7.0.14,
  7.2.3, 7.2.5.
ruby 1.9.3p551: Ruby or BSD-2-clause. Source: ruby/ruby COPYING at v1_9_3_551.
rust-libstd 1.50.0 1.67.1: Apache-2.0 or Expat. Source: rust-lang/rust
  LICENSE-APACHE at 1.50.0, 1.67.1.
rust-libstd-musl 1.67.1: Apache-2.0 or Expat. Source: rust-lang/rust
  LICENSE-APACHE at 1.67.1.
sqlcipher 4.5.5: BSD-3-clause. Source: sqlcipher/sqlcipher LICENSE at v4.5.5.
swipl 9.3.8: BSD-2-clause. Source: SWI-Prolog/swipl-devel LICENSE at V9.3.8.
traefik 1.7.34 2.9.6 2.10.7 2.11.1 3.0.4 3.6.5 3.6.8: MIT. Source:
  traefik/traefik LICENSE.md at v1.7.34, v2.10.7, v2.11.1, v2.9.6, v3.0.4,
  v3.6.5, v3.6.8.
util-linux 2.37.4: GPL-2.0. Source: util-linux/util-linux COPYING at v2.37.4.
valkey-server 9.0.0: BSD-3-clause. Source: valkey-io/valkey COPYING at 9.0.0.
vault 1.11.6 1.14.3: MPL-2.0. Source: hashicorp/vault LICENSE at v1.11.6,
  v1.14.3.
wp 2.9.0: MIT. Source: wp-cli/wp-cli LICENSE at v2.9.0.
xz 5.6.2: 0BSD and GPL-2+ and LGPL-2.1+. Source: tukaani-project/xz COPYING at
  v5.6.2.
zstd 1.5.6: BSD-3-clause or GPL-2. Source: facebook/zstd LICENSE at v1.5.6.

Snippet manager fixtures (3 files)
----------------------------------

Under syft/pkg/cataloger/binary/internal/manager/internal/testdata/snippets/:
busybox 1.3.6 (GPL-2) and postgres 9.6.10 (PostgreSQL), read by the snippet
manager's own tests.
