PLARO Open Source Notices and Distribution Policy
This page describes the open-source software used by the PLARO web service and its current distribution model. Each component remains subject to its own license and notice requirements.
This page is generated from the repository lockfiles and Docker configuration. It is not a legal opinion or a blanket statement that every use is unrestricted; deployed images and changed dependencies must be re-audited.
1. Current operating conclusion
PLARO is operated as a hosted SaaS service: customers are not given PLARO source code, executables, or Docker images. The reviewed open-source components may be used in this operating model, subject to their notices and license conditions.
2. SaaS distribution policy
- PLARO is delivered as a hosted web service. PLARO source code, executables, and Docker images are not distributed to customers.
- Customer-created or uploaded outputs are not themselves a distribution of the open-source libraries. Their rights and use conditions are governed by the Terms of Service.
- License notices and copyright text for browser-delivered JavaScript, icons, and other components are maintained on this page and in shipped artifacts where applicable.
- Before any on-premises, installable, or customer-specific Docker distribution, the complete image, NOTICE files, and corresponding-source obligations will be re-audited and this page will be updated.
3. Key direct components
These are the main components directly used by feature code or installed directly into operational containers. The complete locked inventory follows below.
4. Complete locked dependency inventory
The lists below include all runtime and development/build dependencies from composer.lock and the package-lock.json files for the web client, conversion worker, and mobile app. Package names link to their public distribution pages.
PHP / Composer (151)
Runtime dependencies (115)
Development/build dependencies (36)
Web browser/server JavaScript / NPM (480)
Runtime dependencies (300)
Development/build dependencies (180)
5. Docker and operations components
These components run outside application code as Docker images or OS packages. Image tags alone cannot establish every transitive license, so image digests and an SBOM must be reviewed before customer distribution.
| Package | License | Notes |
|---|---|---|
| FFmpeg (BtbN 정적 빌드, LGPL) | LGPL v2.1+ (--enable-gpl 제외 빌드) | Debian GPL 빌드 → BtbN LGPL 정적 바이너리로 교체, sha256 고정 |
| convert-worker (Node + pdf.js + sharp) | Apache-2.0 / MIT | Poppler(pdftotext/pdffonts/pdftoppm)와 Imagick을 대체하는 내부 변환 서비스 |
| Gotenberg 8.x (내장 LibreOffice 엔진) | MIT + MPL/LGPL 계열 | 기존 LibreOffice+unoserver 변환 worker를 Gotenberg로 오프로드 |
| LiveKit Python agent | Apache-2.0 / BSD-3-Clause | livekit~=0.18, livekit-api~=0.7, aiohttp~=3.10, NumPy~=2.1; requirements가 범위 지정이므로 이미지 릴리스 시 정확한 pip SBOM 필요 |
| PHP / Apache / Debian base images | 각 프로젝트·배포판의 혼합 라이선스 | 이미지 digest와 SBOM 기준 관리 |
| PLARO status API (Go) | Go 표준 라이브러리 및 Go toolchain 라이선스 | 외부 Go 모듈 없음; CGO 비활성 정적 바이너리를 scratch 이미지로 실행 |
| Caddy 2, LiveKit 1.12/egress 1.8, MySQL 8.4, Redis 7 | 프로젝트 및 이미지 하위 패키지별 | 현재 Compose 태그 기준; 고객에게 이미지 미배포 |
| Prometheus 및 exporters | Apache-2.0 및 이미지별 라이선스 | Prometheus 3.12.0, node-exporter 1.11.1, blackbox 0.25.0, Alertmanager 0.27.0, SNMP exporter 0.29.0, NUT exporter 3.1.1 |
6. Additional verification and conditions
- xmlhttprequest-ssl 2.1.2 had an empty lockfile license field, but its installed LICENSE file and legacy licenses field in package.json identify it as MIT. It is currently a development dependency.
- mPDF 8.3.1 is GPL-2.0-only; PHPWord 1.4.0 and Smalot PDFParser 2.12.5 are LGPL-family components. SaaS operation and distribution of an executable or image have different obligations, so an installable distribution requires a separate review.
- FFmpeg can be subject to LGPL or GPL terms depending on build flags. The Debian --enable-gpl build was replaced with a sha256-pinned BtbN LGPL static build; re-verify if the release image changes.
- Poppler (pdftotext/pdffonts/pdftoppm) and Imagick were replaced by an internal convert-worker built on Apache-2.0 pdf.js and sharp; LibreOffice conversion was offloaded to Gotenberg (MIT).
- Some icon and browser-data packages, including Font Awesome free icons and caniuse-lite, may include CC-BY terms; attribution and copyright notices are retained.
7. Contact
For questions about notices or distribution: hyunjaeyoo@plaro.kr