TextOS third-party inventory
Generated from packaged component inventory. See the source repo file docs/release-prep/textos-third-party-inventory.md for the editable engineering audit.
Notices | License texts | Source offer
| Component | Version | Path | License/status | Action | Risk |
|---|---|---|---|---|---|
| Ubuntu Base rootfs | 24.04.4 arm64 | Repo source ubuntu-base-official-arm64.tar.gz; APK asset ubuntu-base-official-arm64.tar | Many Debian/Ubuntu package licenses. | Rootfs package notices and source offer. | High |
| Network Base packages | ca-certificates 20260601~24.04.1; libssl3t64/openssl 3.0.13-0ubuntu3.11 | network-base/*.deb | GPL-2+ packaging metadata, MPL-2.0 certdata, Apache-2.0/OpenSSL notices, embedded Text-Template notice. | Include package notices. | Medium |
| Python Chat Pack | Python 3.12 closure | Installed in guest by pack | Python/PSF plus Debian package notices; readline/netbase flagged. | Include full Python notices and package source offer. | High |
| Python SDK site | openai-codex 0.1.0b3; pydantic 2.13.4; pydantic_core 2.46.4; annotated-types 0.7.0; typing-extensions 4.15.0; typing-inspection 0.4.2 | codex-app-server-sdk-site-slim.tar | Apache-2.0, MIT, PSF-2.0, license file present. | Bundle metadata/license files. | Medium |
| Codex CLI | 0.137.0a4 per prior audit | codex-aarch64-unknown-linux-musl.tar.gz | Apache-2.0 per prior local package audit. | Confirm final source/provenance bundle. | Medium |
| PRoot and loaders | Termux proot v5.1.107.76 lineage | native/libproot.so, loaders; active SHA-256 5f44f031... | GPL-family review required; modified binary. | See textos-proot-source-offer-todo.md; provide modified source/build recipe. | High |
| Dropbear | custom packaged binary | hostssh-dropbearmulti, libdropbearmulti.so; SHA-256 d5ac2de7... | Exact source/license notices need final provenance. | See textos-dropbear-source-offer-todo.md; provide source/build notes. | High |
| Advanced SSH auth | removed from MVP package | Previously hostssh-libtermux-auth.so, libtermux-auth.so | Not shipped in this MVP candidate. | Keep Advanced key SSH hidden until source/license provenance is complete. | Low |
| Access-code SSH auth shim | MVP candidate | hostssh-libtextos-access-auth.so | Original TextOS ABI-compatible shim per release-prep notes. | Keep source/build notes. | Medium |
| OpenSSH SFTP server | 1:9.6p1-3ubuntu13.16 | openssh-sftp-server | OpenSSH BSD/permissive; Debian packaging BSD-2-clause. | Bundled copyright/provenance included. | Low |
| CivetWeb | v1.16 | webdesk-civetweb, libwebdesk_civetweb.so | MIT. | Bundled provenance included. | Low |
| SFTP PR_SET_DUMPABLE shim | TextOS support shim | sftp-libprctl-dumpable-ok.so, source .c | TextOS-owned source. | Include source with release/source offer. | Low |
| Fonts/assets | multiple | files/fonts/* and images | DSEG SIL OFL bundled; most other font files lack local license files. | See textos-font-provenance-todo.md; add license files or replace unknowns. | Medium |
| Legacy EULA asset | removed | Previously assets/EULA | Product-mismatched Construction Calc text. | Removed from the TextOS package; add a TextOS-specific reviewed agreement later only if needed. | Low |
| Legal notice pages | MVP notice bundle | assets/textos-*.html, assets/textos-*.txt | Generated TextOS notice summaries. | Keep synchronized with this inventory. | Low |
Rootfs package baseline
91 packages from Ubuntu Base 24.04.4 arm64. Key packages include apt, bash, coreutils, dash, dpkg, libc6, libgnutls30t64, libgcrypt20, libseccomp2, libssl3t64, perl-base, tar, ubuntu-keyring, util-linux, and zlib1g. Full package/version baseline is recorded in docs/release-prep/textos-third-party-inventory.md.