License

Cinfo code

Copyright © Cinfo Contenidos Informativos Personalizados SL. All rights reserved.

All custom code in this repository is closed source and is the property of Cinfo Contenidos Informativos Personalizados SL. It may not be copied, distributed, modified or used outside Cinfo without written permission.

Third-party open source software

The components below are used under their own licenses. License identifiers follow the SPDX license list. Update this table whenever a dependency is added or removed, and regenerate `sbom.spdx.json` and `sbom.spdx.yml` with it.

backend — runtime

ComponentVersionLicenseLicense text
FastAPI0.118.0MIThttps://spdx.org/licenses/MIT.html
Uvicorn0.37.0BSD-3-Clausehttps://spdx.org/licenses/BSD-3-Clause.html
SQLAlchemy2.0.43MIThttps://spdx.org/licenses/MIT.html
Alembic1.16.5MIThttps://spdx.org/licenses/MIT.html
psycopg3.2.10LGPL-3.0-or-laterhttps://spdx.org/licenses/LGPL-3.0-or-later.html
Pydantic2.11.9MIThttps://spdx.org/licenses/MIT.html
pydantic-settings2.11.0MIThttps://spdx.org/licenses/MIT.html
python-multipart0.0.20Apache-2.0https://spdx.org/licenses/Apache-2.0.html
Jinja23.1.6BSD-3-Clausehttps://spdx.org/licenses/BSD-3-Clause.html
HTTPX0.28.1BSD-3-Clausehttps://spdx.org/licenses/BSD-3-Clause.html
PyJWT2.10.1MIThttps://spdx.org/licenses/MIT.html
cryptography46.0.1Apache-2.0 OR BSD-3-Clausehttps://spdx.org/licenses/Apache-2.0.html
redis-py6.4.0MIThttps://spdx.org/licenses/MIT.html
ItsDangerous2.2.0BSD-3-Clausehttps://spdx.org/licenses/BSD-3-Clause.html
boto31.40.29Apache-2.0https://spdx.org/licenses/Apache-2.0.html

backend — development and test only

ComponentVersionLicenseLicense text
pytest8.4.2MIThttps://spdx.org/licenses/MIT.html
pytest-cov7.0.0MIThttps://spdx.org/licenses/MIT.html
pytest-asyncio1.2.0Apache-2.0https://spdx.org/licenses/Apache-2.0.html

frontend — shipped to the browser

ComponentVersionLicenseLicense text
htmx2.0.7BSD-2-Clausehttps://spdx.org/licenses/BSD-2-Clause.html
Tailwind CSS4.1.13MIThttps://spdx.org/licenses/MIT.html
daisyUI5.1.7MIThttps://spdx.org/licenses/MIT.html

frontend — build only

ComponentVersionLicenseLicense text
@tailwindcss/cli4.1.13MIThttps://spdx.org/licenses/MIT.html
@playwright/test1.55.1Apache-2.0https://spdx.org/licenses/Apache-2.0.html

container images

ComponentVersionLicenseLicense text
PostgreSQL18-alpinePostgreSQLhttps://spdx.org/licenses/PostgreSQL.html
Redis8-alpineAGPL-3.0-onlyhttps://spdx.org/licenses/AGPL-3.0-only.html
MinIOlatestAGPL-3.0-onlyhttps://spdx.org/licenses/AGPL-3.0-only.html
MinIO Client (mc)latestAGPL-3.0-onlyhttps://spdx.org/licenses/AGPL-3.0-only.html
nginxalpineBSD-2-Clausehttps://spdx.org/licenses/BSD-2-Clause.html
nginx-unprivilegedalpineBSD-2-Clausehttps://spdx.org/licenses/BSD-2-Clause.html
OWASP ModSecurity Core Rule Setnginx-alpineApache-2.0https://spdx.org/licenses/Apache-2.0.html
Python3.12-slimPSF-2.0https://spdx.org/licenses/PSF-2.0.html
Node.js22-alpineMIThttps://spdx.org/licenses/MIT.html
Alpine Linuxlatest stableMIThttps://spdx.org/licenses/MIT.html

Note on MinIO

MinIO and its client are distributed under AGPL-3.0-only. Both run as unmodified upstream

containers and this service talks to MinIO over its S3 API, so no Cinfo code is a derivative

work of them. Do not vendor or patch MinIO source into this repository. The backend speaks

plain S3 through boto3, so swapping MinIO for AWS S3 is a configuration change.

Note on Redis

Redis 8 is distributed under AGPL-3.0-only. It runs as an unmodified upstream container and this service communicates with it over the network only, so no Cinfo code is a derivative work of it. Do not vendor or patch Redis source into this repository.

Note on psycopg

psycopg 3 is LGPL-3.0-or-later. It is used as an unmodified library through its public API, which the LGPL permits for closed source software. Do not modify it in place; replace it with a newer release instead.

← Cinfo Artifacts