Licensing
Where WaferCMS publishes license notices and release assets
WaferCMS's own source code is MIT licensed. Published server and client images also contain their base operating systems and third-party software.
In the images
Notices for software included in each image are under /licenses:
| Path | Contents |
|---|---|
LICENSE and *.LICENSE | WaferCMS and workspace MIT license files |
THIRD_PARTY_NOTICES | Production npm dependency attributions and license texts |
OS-PACKAGES-NOTICE | Exact installed Alpine package inventory and source metadata |
GPL-*.txt, LGPL-*.txt | Canonical GPL/LGPL texts used by bundled components |
runtime/ (server) | Bundled Node.js, npm, Yarn, optional Corepack, and globally installed pnpm notices |
sharp-libvips/ (server) | Installed platform package license and source metadata |
caddy/ (client) | Caddy LICENSE, Go module notices/texts, and MPL Covered Software source archives |
Apache-2.0.txt (client) | Canonical Apache 2.0 text for Caddy |
CID=$(docker create ghcr.io/ashutoshbind15/wafercms-server:latest)
docker cp "$CID:/licenses/." ./wafercms-server-licenses
docker rm "$CID"On GitHub Releases
Each vX.Y.Z release attaches:
wafercms-vX.Y.Z-corresponding-source.tar.zst— Alpine distfiles and matchingAPKBUILDdirectories for GPL/LGPL packages in the images, plus thesharp-libvipssource workspace used by the serverwafercms-vX.Y.Z-source-manifest.json— maps immutable image digests and architectures to paths in that archive- CycloneDX and SPDX SBOMs for server and client
- Per-image
/licensesarchives
Compose samples may also pull third-party images such as Postgres, RustFS, and an optional edge Caddy from those projects' own registries; they are not part of the WaferCMS image releases.