Research-2140: Licence audit of the published production artifacts¶
Audit date 2026-10-04. Input to ADR-1513, which applies the tester rules of ADR-1503 to the production artifacts. Every row comes from the published bytes: the v1.0.0-rc.2 images were exported per platform with crane export (the 20.9 GB ROCm image by streaming its layers), the release assets downloaded with gh release download, the PyPI files read from the release, and the licence terms from the texts listed under Licence sources. licensing.py scan-build of the CPU release configuration gives the licences of the VMAFx binaries; the Go modules are those of each binary's build information, classified from the module's own LICENSE and NOTICE files.
Severity: breaks = a licence condition is unmet by what is published; weak = arguable, or a pass-on term missing where the grant still holds; cosmetic = metadata wrong, no condition unmet.
licensing.py scan-build of the CPU release configuration (359 compiled files): EUPL-1.2, BSD-2-Clause-Patent (Netflix 2016-2026), BSD-3-Clause (IQA / Tom Distler, libsvm / Chang & Lin, libjxl), BSD-2-Clause (Xiph, Daala, dav1d / VideoLAN, Two Orioles), ISC (x264 x86inc.asm), MIT (CIEDE2000 / Joshua Holmer, Stephen Mathieson), Unlicense, LicenseRef-LIVE-BRISQUE (embedded model). BSD-2/3 clause 2, ISC and MIT require the notice and licence in the documentation or other materials of a binary distribution; the LIVE notice must appear "in its entirety in all copies". EUPL-1.2 Art. 5 asks a distributor to provide or point to the source. No published artifact carries any of these texts except NOTICE-brisque (inside the model directory).
various; Cython, flatbuffers, onnxruntime keep no licence file in their dist-info; vmaf-mcp / vmaf-tune declare BSD-2-Clause-Patent, files are EUPL-1.2, no licence file
licence text per package
mostly; 5 without
grafted libgfortran (build IDs 04dbe32d…, 5bbe74eb…) and libquadmath (c1c5f8d6…, 549b4c82…) in numpy/scipy
GPL-3+ WITH GCC-exception, LGPL-2.1+
corresponding source
no (same IDs the tester record already maps to SRPMs)
87 Debian packages
77 name GPL/LGPL
source at the same place
no
build tools left in the runtime venv (build, hatchling, Cython, setuptools, wheel)
VMAFx set + NVIDIA device code (CUDA headers inlined, libdevice.10.bc linked by nvcc)
CUDA EULA v13.4 (2026-01-26) 1.1.1(c), 1.1.2(a)(b)(e): distributable portions in object code inside an application with material additional functionality, accessed only by it, terms consistent with the EULA
VMAFx notices no; NVIDIA terms not passed on
nv-codec-headers code compiled into libvmaf
MIT
notice
no
cuda-cudart-13-4 13.4.92-1 (libcudart.so.13.4.92, Attachment A)
CUDA EULA (its dpkg copyright file is the v13.4 text)
1.1.2(b) only accessed by our application; unmodified (2.3)
unmodified yes; not loaded by libvmaf (readelf -d: no NVIDIA NEEDED), so it is a vendor file in a general image that any program can load
AMD Software End User License Agreement (ROCm/rocprof-trace-decoderLICENSE): §2 grants use and distribution of Derivative Works only; §3.2: you may not "distribute, publish, display, sublicense, assign or otherwise transfer the Software"
EULA 2.1.D(1) only as part of our product; (2) executable code only and under a licence agreement that prohibits reverse engineering; (4)(iii) no Intel marks. ISSL: notice and terms reproduced, no reverse engineering
texts present inside /opt/intel; no pass-on of 2.1.D(2) terms; most of the set is not used by libvmaf
Master recipe (ADR-1368) installs intel-oneapi-runtime-dpcpp-cpp intel-oneapi-umf plus the NEO runtime set on Debian 13: smaller, but still the meta-package set ADR-1505 measured at 1.1 GB with OpenCL CPU device, OpenMP offload and LTO plugin, and no pass-on of 2.1.D(2).
Go server, operator images (distroless cc / static)¶
configured --enable-gpl --enable-version3 --enable-nonfree: ffmpeg -L prints "This version of ffmpeg has nonfree parts compiled in. Therefore it is not legally redistributable." (no nonfree component is actually enabled: decklink, libfdk_aac, libmpeghdec, cuda_nvcc, cuda_sdk absent from the configure line; the build is otherwise GPL-3.0-or-later)
do not redistribute a nonfree build; GPL-3 §4, §6: licence text, corresponding source (FFmpeg + patches + configure line + linked GPL libraries)
no — self-declared unredistributable, no text, no source
REUSE wrong: computed notices would drop the upstream notice
tiny/transnet_v2.*
REUSE: BSD-2-Clause-Patent Lusoris; registry + card: MIT upstream (Copyright (c) 2020 Tomáš Souček)
REUSE wrong
predictor_*.onnx, konvid_mos_head_v1.*, *_card.md at model/ root
REUSE model/**: "2016-2020 Netflix, Inc."
fork-trained, wrong holder
fr_regressor_v1, vmaf_tiny_v1..v4
BSD-2-Clause-Patent
trained on the Netflix Public Dataset, whose licence forbids redistribution; the card argues the weights are not a redistribution (legal reading)
saliency_student_v1/v2
BSD-2-Clause-Patent
trained on DUTS-TR, "free for academic and research purposes"
nr_metric_v1, learned_filter_v1, vmaf_tiny_v2+
BSD-2-Clause-Patent
cards state KoNViD-1k is "CC BY 4.0"; the database page (read 2026-10-04) says only "freely available to the research community"; its videos are YFCC100M CC clips of mixed licences
libvmaf-build stage: full CUDA toolkit (install-cuda-toolkit.sh --mode=full: nvcc, headers, tools: not Attachment A), intel-basekit (compilers and libraries; Intel EULA allows only Redistributables, 2.1.D), ROCm payload. Private, org has one member: internal use (CUDA EULA 1.1.1(a), Intel EULA 2.1.A) holds. Making it public, or granting outside access, would distribute non-distributable toolkit files.
mkdocs.yml: copyright: "BSD-2-Clause-Patent — Netflix / Lusoris". Since ADR-1250 fork-authored files are EUPL-1.2 and the per-file SPDX header decides.
FFmpeg configured --enable-nonfree; the binary declares itself "not legally redistributable"
vmafx-node rc.1, rc.2
do not redistribute a nonfree build
FFmpeg n9.0.2 configure (line 102, 4840), ffmpeg -L of the published binary
breaks
3
ROCm image final stage is the whole 20.9 GB dev image: ROCgdb (GPL-3.0) without source, compilers, SDK libraries for 28 targets, amdrocm-* packages without copyright files
-rocm10 rc.1, rc.2
GPL-3 §6; component notices
ROCm 10.0.0 licensing page, NOTICES.txt
breaks
4
GPL-3.0-or-later FFmpeg + GPL-2+ x264/x265 shipped without licence text or corresponding source
vmafx-node
GPL-3 §4, §6
GPL-3.0 text
breaks
5
40 Debian libraries copied out of their packages without copyright files, notices or source; SVT-AV1 without notice; rclone with LGPL-3.0 and MPL-2.0 modules, no notices, no source
CUDA Toolkit EULA v13.4, last updated 2026-01-26: https://docs.nvidia.com/cuda/eula/index.html 1.1.1(c), 1.1.2(a)-(f), 2.2, 2.3, Attachment A (libcudart.so, libcuda.so, libnvidia-ptxjitcompiler.so, libdevice.10.bc); the same text is the copyright file of cuda-cudart-13-4 13.4.92-1 in the image.
Intel End User License Agreement for Developer Tools (Version August 2024) 2.1.D and Intel Simplified Software License (Version October 2022): texts shipped in the published oneAPI image (/opt/intel/oneapi/redist/share/doc/*/licensing/); ADR-1503 read the 2026.0 compiler's copy on 2026-10-03.
Upstream model licences: richzhang/PerceptualSimilarity LICENSE (BSD-2-Clause, Copyright (c) 2018 Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, Oliver Wang); soCzech/TransNetV2 LICENSE (MIT, Copyright (c) 2020 Tomáš Souček); m-tassano/fastdvdnet LICENSE at c8fdf61 (MIT, Copyright 2024 Matias Tassano).
Go module licences: each module's LICENSE* / NOTICE* from the Go module cache at the versions in the binaries' build info; cloudsoda/sddl LGPL-3.0; hashicorp and riverqueue modules MPL-2.0.
GPL-2.0, GPL-3.0, LGPL-2.1, LGPL-3.0, Apache-2.0, MPL-2.0 texts: /usr/share/common-licenses/ of the images and the module LICENSE files.
FFmpeg built --enable-nonfree ("not legally redistributable"); GPL/LGPL libraries and rclone's LGPL-3.0 module without source; no notices
withdraw; republish from the gated recipe (no --enable-nonfree, -source companion)
CPU, server, CUDA, oneAPI images of rc.1 and rc.2; vmafx-server, vmafx-operator rc.1 and rc.2
no notices (BSD, ISC, MIT, Apache-2.0 NOTICE), no source for the GPL/LGPL base packages, grafted GCC runtimes and MPL-2.0 modules; Intel runtime without the EULA 2.1.D(2) pass-on
either withdraw and rebuild as v1.0.0-rc.3 from the gated recipes, or publish <tag>-source companions for the existing digests and a notices file on each release page; rc.3 from the gated recipes is the cleaner path