BomLens
Copyright 2026 SK Telecom Co., Ltd.

This product is licensed under the Apache License, Version 2.0 (see LICENSE).

This product bundles third-party open-source tools within its Docker images
to perform SBOM generation and analysis. Those tools are separate programs,
invoked at arm's length (as separate processes), and remain under their own
respective licenses. A full inventory of bundled tools, their licenses, and
the corresponding source locations is provided in THIRD_PARTY_LICENSES.md.

This product also bundles reduced snapshots of third-party data so that its
offline checks need no network access at scan time: end-of-life dates from
endoflife.date (MIT), and malicious-package advisories from the OSV bulk
archives, whose MAL- records are published by the OpenSSF Package Analysis
project (ossf/malicious-packages, Apache-2.0). The images also carry a CPE
applicability index derived from the U.S. National Vulnerability Database,
with its own attribution and notices in CVE-DATA-NOTICE.txt beside it.
Neither project endorses or certifies this product. Details are in
THIRD_PARTY_LICENSES.md.

The tools BomLens installs into its base image (ghcr.io/sktelecom/bomlens) are
permissively licensed (Apache-2.0 / MIT). The heavy unpacking and binary-analysis
tools that are themselves GPL-licensed are isolated in a separate opt-in image
(ghcr.io/sktelecom/bomlens-firmware).

Every image, the base one included, is built on a Debian-based Python image and
therefore also contains Debian system packages under the GNU GPL (versions 2 and
3), the GNU LGPL, and other licenses — bash, coreutils, grep, sed, tar, gzip and
git among them. That is inherent to any Linux base image and is not specific to
this project. Each package's license and copyright statement is preserved inside
the image at /usr/share/doc/<package>/copyright, and directions to the
corresponding source for all of them are in THIRD_PARTY_LICENSES.md.
