# Open-source notice: exercism-python-test-runner 2026.09.22

This is the source and license set for the OxideVM image **exercism-python-test-runner** version **2026.09.22**:
the Exercism Python test runner, Docker image `docker.io/exercism/python-test-runner@sha256:609b6d4d19a0d586dfaeaab3bc50539783b6dd5b41ba8b7e8c7e06ce56bb69f5`,
converted into an OxideVM Userspace image **without modification**. All 3728
non-directory entries of the image filesystem (regular files, symbolic links and hard links;
inventory SHA-256 `4e3a63186efb2faadeca5bb4842f9c5107ec510af101c321dbad864f20bfdfe8`) are byte-identical to the merged layers of
that Docker image. Nothing was added, removed or changed.

## Who made it

The test runner and its exercises are the work of [Exercism](https://exercism.org). The runner is
[github.com/exercism/python-test-runner](https://github.com/exercism/python-test-runner) at commit
`4ccf07b33c68569e59e8c421a5b9067b1be0acc1`, published by Exercism under the GNU Affero General Public License version 3.
Exercism built and published the Docker image. The image also contains 43 other packages,
listed below: Alpine Linux 3.23.6 packages, CPython 3.13.15 and Python packages from PyPI.
Each keeps its own license and its authors' copyright.

## OxideVM is separate software

The OxideVM engine that runs this image in a web browser is separate proprietary software of
Spacia B.V. It is not part of this image, it is not distributed in this set, and it is not covered
by any license listed here. Running the image in the engine does not change the license of any
program in the image; the programs and the engine are separate works distributed side by side.

## Open-source licenses prevail

The open-source licenses of the programs in this image prevail for those programs. Nothing in
Spacia's terms limits the rights they give you: you may use, study, modify and redistribute each
program under its own license. Spacia's image signature only authenticates this copy; you can build,
sign and run modified images with your own keys.

## Contents of this set

- `sbom.spdx.json`: SPDX 2.3 inventory; every image file with its SHA-256, attributed to exactly one package with a concluded license.
- `sbom.cdx.json`: CycloneDX 1.6 SBOM with every package of the image (also the APK meta or virtual entries that install no files: .python-rundeps), its license, purl and, for copyleft packages, the source download.
- `licenses/` (one file per license or exception) and `licenses/NOTICES.txt`: every package's license text, copyright and notice lines, collected from the upstream sources and installed files.
- `sources/<package>-<version>/`: the complete corresponding source of every package that carries source duties.
- `SHA256SUMS`: SHA-256 of every file in this set.

The same materials are published at https://github.com/spacia-ai/greenbar-sources/releases/tag/image-exercism-python-test-runner-v2026.09.22.

## Packages

| Package | Version | License | Files | Source |
| --- | --- | --- | --- | --- |
| alpine-baselayout | 3.7.2-r0 | `GPL-2.0-only` | 13 | [sources/alpine-baselayout-3.7.2-r0/](sources/alpine-baselayout-3.7.2-r0/) |
| alpine-baselayout-data | 3.7.2-r0 | `GPL-2.0-only` | 15 | [sources/alpine-baselayout-3.7.2-r0/](sources/alpine-baselayout-3.7.2-r0/) |
| alpine-keys | 2.6-r0 | `MIT` | 41 | notices only |
| alpine-release | 3.23.6-r0 | `MIT` | 5 | notices only |
| apk-tools | 3.0.8-r0 | `GPL-2.0-only` | 11 | [sources/apk-tools-3.0.8-r0/](sources/apk-tools-3.0.8-r0/) |
| attrs | 26.1.0 | `MIT` | 36 | notices only |
| bash | 5.3.3-r1 | `GPL-3.0-or-later` | 43 | [sources/bash-5.3.3-r1/](sources/bash-5.3.3-r1/) |
| black | 25.1.0 | `MIT AND PSF-2.0` | 57 | notices only |
| busybox | 1.37.0-r30 | `GPL-2.0-only` | 310 | [sources/busybox-1.37.0-r30/](sources/busybox-1.37.0-r30/) |
| busybox-binsh | 1.37.0-r30 | `GPL-2.0-only` | 1 | [sources/busybox-1.37.0-r30/](sources/busybox-1.37.0-r30/) |
| ca-certificates | 20260909-r0 | `MPL-2.0 AND MIT` | 368 | [sources/ca-certificates-20260909-r0/](sources/ca-certificates-20260909-r0/) |
| ca-certificates-bundle | 20260909-r0 | `MPL-2.0 AND MIT` | 4 | [sources/ca-certificates-20260909-r0/](sources/ca-certificates-20260909-r0/) |
| click | 8.5.0 | `BSD-3-Clause` | 23 | notices only |
| cpython | 3.13.15 | `PSF-2.0 AND MIT AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0 AND dtoa` | 1052 | [sources/cpython-3.13.15/](sources/cpython-3.13.15/) |
| exercism-python-test-runner | 4ccf07b33c68 | `AGPL-3.0-only` | 19 | [sources/exercism-python-test-runner-4ccf07b33c68/](sources/exercism-python-test-runner-4ccf07b33c68/) |
| gdbm | 1.26-r0 | `GPL-3.0-or-later` | 4 | [sources/gdbm-1.26-r0/](sources/gdbm-1.26-r0/) |
| iniconfig | 2.3.0 | `MIT` | 11 | notices only |
| libapk | 3.0.8-r0 | `GPL-2.0-only` | 1 | [sources/apk-tools-3.0.8-r0/](sources/apk-tools-3.0.8-r0/) |
| libbz2 | 1.0.8-r6 | `bzip2-1.0.6` | 2 | notices only |
| libcrypto3 | 3.5.8-r0 | `Apache-2.0` | 10 | notices only |
| libffi | 3.5.2-r0 | `MIT` | 2 | notices only |
| libncursesw | 6.5_p20251123-r0 | `X11` | 2 | notices only |
| libpanelw | 6.5_p20251123-r0 | `X11` | 2 | notices only |
| libssl3 | 3.5.8-r0 | `Apache-2.0` | 1 | notices only |
| libuuid | 2.41.6-r1 | `BSD-3-Clause` | 2 | notices only |
| musl | 1.2.5-r23 | `MIT` | 2 | notices only |
| musl-utils | 1.2.5-r23 | `MIT AND BSD-2-Clause AND GPL-2.0-or-later` | 5 | [sources/musl-1.2.5-r23/](sources/musl-1.2.5-r23/) |
| mypy_extensions | 1.1.0 | `MIT` | 6 | notices only |
| ncurses-terminfo-base | 6.5_p20251123-r0 | `X11` | 41 | notices only |
| packaging | 26.3 | `BSD-2-Clause` | 30 | notices only |
| pathspec | 1.1.1 | `MPL-2.0` | 37 | [sources/pathspec-1.1.1/](sources/pathspec-1.1.1/) |
| pip | 26.2.1 | `MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MPL-2.0 AND PSF-2.0` | 481 | [sources/pip-26.2.1/](sources/pip-26.2.1/) |
| platformdirs | 4.11.12 | `MIT` | 15 | notices only |
| pluggy | 1.6.0 | `MIT` | 15 | notices only |
| Pygments | 2.21.0 | `BSD-2-Clause` | 351 | notices only |
| pytest | 8.4.2 | `MIT` | 85 | notices only |
| pytest-subtests | 0.14.2 | `MIT` | 11 | notices only |
| readline | 8.3.1-r0 | `GPL-3.0-or-later` | 3 | [sources/readline-8.3.1-r0/](sources/readline-8.3.1-r0/) |
| scanelf | 1.3.8-r2 | `GPL-2.0-only` | 1 | [sources/pax-utils-1.3.8-r2/](sources/pax-utils-1.3.8-r2/) |
| sqlite-libs | 3.53.4-r0 | `blessing` | 2 | notices only |
| ssl_client | 1.37.0-r30 | `GPL-2.0-only` | 1 | [sources/busybox-1.37.0-r30/](sources/busybox-1.37.0-r30/) |
| tzdata | 2026d-r0 | `LicenseRef-tzdata-2026d` | 603 | notices only |
| xz-libs | 5.8.4-r0 | `0BSD` | 2 | [sources/xz-5.8.4-r0/](sources/xz-5.8.4-r0/) |
| zlib | 1.3.2-r0 | `Zlib` | 2 | notices only |

## Corresponding source

Every package under GPL, LGPL, MPL or AGPL terms has its complete corresponding source in `sources/`:
for Alpine packages the exact aports recipe directory at the commit Alpine built it from (APKBUILD,
every patch and extra file) and the original upstream archives, each verified against the recipe's
SHA-512 checksums; for the Exercism runner a `git archive` of the commit, Dockerfile included;
for PyPI packages the published source distribution; for CPython the release archive and the docker-library Dockerfile that built it, because its readline, _gdbm and _dbm modules link GPL libraries.
Each kit has a `BUILD.md` with the rebuild steps and a `SHA256SUMS`. The sources are kept for as long as the image is offered.

## Libraries under the LGPL

None.

## Notes

- Spacia did not modify any program in this image and did not build any of its binaries.
- License conclusions record the selected branch of every `OR` choice and the evidence for every correction of a distribution label in the SPDX package comments and in `NOTICES.txt`.
- Packages under a package-specific grant: tzdata 2026d-r0 (`LicenseRef-tzdata-2026d`). Each grant's text is the package's complete notice and is published under the grant's name (`<grant>.txt`) in `licenses/`; the reasoning for the package's conclusion is in its SPDX `licenseComments`.
- Where a package ships no copyright notice, the notices say so; no attribution was invented.