NOTICE

Cavil — Third-Party Data Attributions
=====================================

Cavil itself is distributed under the GNU General Public License v2.0 (see the
COPYING file). Its license patterns are curated by the SUSE lawyers.

In addition, Cavil bundles and builds upon data from the third-party sources
listed below. These resources are refreshed with:

    perl tools/update_licenses.pl


ScanCode LicenseDB
------------------
Source:  https://scancode-licensedb.aboutcode.org/
Bundled: lib/Cavil/resources/license_list_scancode.txt
License: Creative Commons Attribution 4.0 International (CC-BY-4.0)
         https://creativecommons.org/licenses/by/4.0/
Credit:  ScanCode LicenseDB, Copyright (c) nexB Inc. and others (AboutCode.org).

Cavil uses the ScanCode license keys to provide "LicenseRef-scancode-*" license
identifiers, as required by BSI TR-03183-2 section 6.1 for licenses that are not
defined by SPDX. Use of this data is subject to the CC-BY-4.0 attribution terms.


SPDX License List and specification
-----------------------------------
Source:  https://spdx.org/licenses/ and https://spdx.dev/
         https://raw.githubusercontent.com/spdx/license-list-data/main/json/licenses.json
Bundled: lib/Cavil/resources/license_list.txt
         lib/Cavil/resources/license_exceptions.txt
         lib/Cavil/resources/license_flags.json
         t/resources/spdx-3.0.1-schema.json
         t/resources/spdx-3.0.1-context.jsonld
License: Creative Commons Zero v1.0 Universal (CC0-1.0)
         https://creativecommons.org/publicdomain/zero/1.0/
Credit:  SPDX(R) is a project of the Linux Foundation. The SPDX License List
         and SPDX specification artifacts are Copyright (c) the SPDX Workgroup,
         a Linux Foundation Project.

Cavil uses the SPDX license and exception identifiers to name licenses, and the
SPDX 3.0.1 JSON schema and JSON-LD context to generate and validate SBOMs. From
the machine-readable license list it also takes the OSI approval and FSF "libre"
classification flags, which are shown per license in the report. No attribution
is required for CC0 data; SPDX is credited here alongside the other sources
anyway.


OSADL Open Source License Compliance Checklists
-----------------------------------------------
Source:  https://www.osadl.org/fileadmin/checklists/matrixseqexpl.json
         https://www.osadl.org/checklists
Bundled: lib/Cavil/resources/license_compatibility.json
License: Creative Commons Attribution 4.0 International (CC-BY-4.0)
         https://creativecommons.org/licenses/by/4.0/
Credit:  (c) 2017-2024 Open Source Automation Development Lab (OSADL) eG and
         contributors.

         A project by the Open Source Automation Development Lab (OSADL) eG.
         For further information about the project see the description at
         www.osadl.org/checklists.

Cavil bundles the OSADL license compatibility matrix and presents it, per package,
as OSADL's own sub-matrix for the licenses that package contains. The directional
verdicts and their explanations are shown verbatim; Cavil does not reinterpret,
collapse or rewrite them. Use of this data is subject to the CC-BY-4.0 attribution
terms.

Please note that OSADL describes this data as work in progress and provides it
without any warranty as to correctness, usefulness, merchantability or fitness
for a particular purpose. Cavil surfaces it as advisory guidance only; it does
not constitute legal advice.


OSADL Open Source License Obligations Checklists
------------------------------------------------
Source:  https://www.osadl.org/fileadmin/checklists/all/jsonlicenses-opt.txt
         https://www.osadl.org/fileadmin/checklists/copyleft.json
         https://www.osadl.org/fileadmin/checklists/sourcedisclosure.json
         https://www.osadl.org/checklists
Bundled: lib/Cavil/resources/license_obligations.json
License: Creative Commons Attribution 4.0 International (CC-BY-4.0)
         https://creativecommons.org/licenses/by/4.0/
Credit:  (c) 2017-2024 Open Source Automation Development Lab (OSADL) eG and
         contributors.

         A project by the Open Source Automation Development Lab (OSADL) eG.
         For further information about the project see the description at
         www.osadl.org/checklists.

Cavil bundles the OSADL per-license obligation checklists (the obligations for using
a license, grouped by delivery use case) together with OSADL's copyleft and source-
code-disclosure classifications, and presents them, per license in a package, as
OSADL's own checklist for that license. The obligations are shown verbatim; Cavil
does not reinterpret, collapse or rewrite them. Use of this data is subject to the
CC-BY-4.0 attribution terms.

Please note that OSADL describes this data as work in progress and provides it
without any warranty as to correctness, usefulness, merchantability or fitness
for a particular purpose. Cavil surfaces it as advisory guidance only; it does
not constitute legal advice.