Open Source Licenses & SBOM¶
Repod is open source and relies on open source components. This page documents the license structure, the Software Bill of Materials (SBOM), and how to verify the component inventory of your deployment.
Repod license¶
The Repod source code — backend (FastAPI/Python) and frontend (React) — is released under the GNU Affero General Public License v3.0 (AGPL-3.0-only).
See the full text in the repository's LICENSE file.
A commercial license without the AGPL's network-copyleft obligations
(Article 13) is available — see
LICENSE-COMMERCIAL.md.
Contributors agree to a Contributor License Agreement
that enables this dual-licensing model.
Why AGPL-3.0 + commercial dual license?¶
- Network copyleft (§13): ensures that anyone offering Repod (or a modified version) as a network service shares their modifications with their users — protects the open source project from unattributed SaaS forks.
- Explicit patent grant (§11): protects users from patent claims by contributors.
- Commercial alternative: organizations that need to embed Repod in a
proprietary product or avoid the AGPL's source-disclosure obligations can
purchase a commercial license (see
LICENSE-COMMERCIAL.md). - Compatible with Apache 2.0 dependencies: Grype and Syft (both Apache 2.0) integrate without license friction — Apache 2.0 is one-way compatible with AGPL-3.0/GPL-3.0.
Third-party components¶
Repod's Docker images include third-party tools. Each component retains its original license; no component's license propagates to Repod's own code (see below).
GPL v2 components¶
| Component | Version | License | Usage | Source |
|---|---|---|---|---|
| reprepro (APT only) | 5.4.6 | GPL v2 | APT repo management — invoked via subprocess.exec() |
salsa.debian.org |
| createrepo_c (RPM only) | 1.2.0 | GPL v2 | RPM repo indexing — invoked via subprocess.exec() |
github.com/rpm-software-management/createrepo_c |
| rpm (RPM only) | 4.20.1 | GPL v2 / LGPL v2 | RPM package querying — invoked via subprocess.exec() |
github.com/rpm-software-management/rpm |
| ClamAV | 1.4.3 | GPL v2 | Antivirus scanning — accessed via clamd Unix socket |
github.com/Cisco-Talos/clamav |
Apache 2.0 components¶
| Component | License | Role |
|---|---|---|
| Grype v0.112.0 | Apache 2.0 | CVE vulnerability scanning |
| Syft v1.44.0 | Apache 2.0 | SBOM generation |
| Requests | Apache 2.0 | HTTP client library |
| Prometheus Client | Apache 2.0 | Metrics export |
MIT components¶
| Component | License | Role |
|---|---|---|
| FastAPI 0.136.1 | MIT | Backend web framework |
| React | MIT | Frontend UI library |
| Tailwind CSS | MIT | CSS framework |
| axios | MIT | Frontend HTTP client |
| APScheduler | MIT | Scheduled jobs (SLA checks, security sync) |
| react-hot-toast | MIT | Notification UI |
| react-router-dom | MIT | Client-side routing |
Full attribution details are in the repository's NOTICES file.
GPL v2 isolation¶
Mere aggregation of GPL v2 components
GPL v2 applies to derivative works — code that is statically or dynamically
linked against a GPL library. Repod does not link against libreprepro,
libclamav, or librpm. All GPL v2 tools are called as independent processes
via subprocess.exec() or Unix socket communication, and are distributed
alongside Repod's Docker images as mere aggregation rather than as a
combined/derivative work.
Since Repod's own code is licensed under the AGPL-3.0 (itself a strong
copyleft license), GPL v2 compatibility is not a blocking concern for
Repod's own license — the isolation above mainly matters for downstream
users who obtain a commercial license under LICENSE-COMMERCIAL.md and
need to confirm that no GPL v2 obligations are introduced into their
proprietary deployment.
If you modify Repod to statically link against any GPL v2 library, you would create a derivative work and GPL v2 obligations would apply to that modification.
Software Bill of Materials (SBOM)¶
Repod publishes machine-readable SBOMs for each release in CycloneDX JSON format.
Download¶
| Image | Format | File |
|---|---|---|
Backend (backend-api, all REPO_FORMAT values) |
CycloneDX JSON | repod-backend.sbom.cdx.json |
Frontend (frontend-ui) |
CycloneDX JSON | repod-frontend.sbom.cdx.json |
Verify the SBOM against your deployment¶
# Install Syft
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \
| sh -s -- -b /usr/local/bin
# Generate a fresh SBOM of your running image
syft scan docker:repodata-backend:latest \
-o cyclonedx-json=my-repod-backend.sbom.cdx.json
# Scan the SBOM for vulnerabilities
grype sbom:my-repod-backend.sbom.cdx.json
Scan for license compliance¶
# List all licenses in the image
syft scan docker:repodata-backend:latest \
-o table \
| awk '{print $NF}' | sort -u
Repod generates SBOMs for your packages¶
In addition to publishing its own SBOM, Repod generates SBOMs for the packages
it manages. Every uploaded package gets a CycloneDX 1.5 and SPDX 2.3 manifest
stored in /repos/manifests/.
# Download the SBOM for a specific package (CycloneDX)
curl -H "Authorization: Bearer $TOKEN" \
"http://localhost:8000/api/v1/sbom/mypackage/1.0.0?format=cyclonedx&arch=amd64" \
-o mypackage-sbom.cdx.json
# Or the entire repository
curl -H "Authorization: Bearer $TOKEN" \
"http://localhost:8000/api/v1/sbom/export?format=cyclonedx" \
-o repod-full-sbom.cdx.json
This is the feature that makes Repod directly useful for NIS2 Article 21 supply chain audits — every package in your infrastructure has a machine-readable provenance record.