Skip to content

Open-source licences

K-Lake ships open-source software from other authors inside its images and its console. Most of those licences (MIT, Apache-2.0, BSD) allow redistribution on one condition: the licence text and copyright notices travel with the software. From 0.1.53, K-Lake carries those notices and shows them to administrators.

This page is about third-party software. K-Lake's own product licence (capacity, expiry, paid features) is covered in Licensing.

Settings › About › Open-source licences

Tenant administrators and cluster administrators see every package in one searchable list, under Settings › About › Open-source licences in the console. The list can be filtered by licence and by part of the product, each licence text is a click away, and everything can be downloaded as one third-party-notices.txt for your own records or a procurement review.

The same information is available from the REST API:

GET /api/about/licences               the server's packages and their licence text ids
GET /api/about/licences/texts/:id     one licence text (text/plain)
GET /api/about/licences/notices.txt   everything as one file

All three need a tenant-admin or cluster-admin token (403 otherwise). Many packages share one licence text, so texts are returned once and referred to by id. The console adds its own packages to the list and to the download.

Where the notices are

  • In the server image, under /usr/share/kdbl/licenses/: every package built in, with its version, licence and licence texts, and the binaries added to the image with where their licence files sit. Operating-system packages keep their own /usr/share/doc/<package>/copyright files.
  • In the console, served beside it as /licenses/console.notices.json: the packages that ended up in the console bundle.
  • Oracle Instant Client, used only by Oracle Database warehouses, ships unmodified in its own image, as Oracle's licence requires, with Oracle's licence and readme and the licence of the library it depends on. It is deployed only when you turn Oracle warehouses on (warehouses.oracle.enabled), and its packages then appear in the list with their licence texts. On a deployment without Oracle they do not appear.

How licences are kept in check

Every change to K-Lake's dependencies is checked automatically against an allowlist of permissive licences. A copyleft licence (GPL, LGPL, AGPL, MPL, SSPL) or a dependency with no declared licence fails the check: admitting one is a deliberate decision, never a side effect of a dependency update. Any binary added to an image is recorded with its version and licence, and the build fails if one is missing its licence file.

Known gaps

  • The extractor images are not yet in the Settings list. Until they are, each package's licence text ships inside the image with the package.
  • Database, cache and web-server images rely on their operating-system copyright files and upstream notices; they are not in the Settings list.