NOTICE

Node.js images on Wolfi
Copyright 2026 Pair-AI-Platform

This repository is licensed under the Apache License, Version 2.0 (see LICENSE). That license covers
the image definitions, workflows, scripts and documentation in it. It does not cover the software
inside the images.

Third-party software in the published images
--------------------------------------------
Every image is assembled from Wolfi packages (https://packages.wolfi.dev), each under its upstream
license; the Wolfi build recipes are Apache License 2.0 (https://github.com/wolfi-dev/os). The SPDX
SBOM attached to every image and every GitHub release lists the license of each package. Among
them:

- Node.js: MIT License.
- glibc: LGPL-2.1-or-later. OpenSSL: Apache License 2.0. ICU: Unicode License.
- In the development images also: busybox (GPL-2.0-only), bash (GPL-3.0-or-later),
  git (GPL-2.0-only), GCC (GPL-3.0-or-later with the GCC Runtime Library Exception), Python (PSF).

Source code for the GPL and LGPL packages is available from their upstream projects and from the
Wolfi build recipes, which name the exact upstream source and version of every package. On request,
we provide the corresponding source of any package in an image we published, for three years after
that image's release.

Tools used in the build pipeline (used, not distributed)
--------------------------------------------------------
apko, oras, cosign and Grype: Apache License 2.0. OpenSCAP: LGPL-2.1-or-later. The STIG content
(Wolfi package chainguard-security-guide): Apache License 2.0.

Trademarks
----------
Node.js, Wolfi, Chainguard and other names are trademarks of their respective owners. They are used
only to identify the software involved. This project is not affiliated with or endorsed by the
OpenJS Foundation, Chainguard, DISA, or any regulator named in the README.