# Open-source notice: exercism-ruby-test-runner 2026.11.01

This is the source and license set for the OxideVM image **exercism-ruby-test-runner** version **2026.11.01**:
the Exercism Ruby test runner, Docker image `docker.io/exercism/ruby-test-runner@sha256:248aa1a0ad41479b9f1e6c89b82854a88c17b04675c77b82b192cf10a563c9b3`,
converted into an OxideVM Userspace image **without modification**. All 5059
non-directory entries of the image filesystem (regular files, symbolic links and hard links;
inventory SHA-256 `9b49f0267bb9a8cb909f0f397df01d1062533870bf5498f1663afdb5abf40c48`) are byte-identical to the merged layers of
that Docker image. Nothing was added, removed or changed.

## Who made it

The test runner and its exercises are the work of [Exercism](https://exercism.org). The runner is
[github.com/exercism/ruby-test-runner](https://github.com/exercism/ruby-test-runner) at commit
`4dcaecc3fc5ff746f4d8d9b002ef3421f94cf7c0`, published by Exercism under the GNU Affero General Public License version 3.
Exercism built and published the Docker image. The image also contains 62 other packages,
listed below: Alpine Linux 3.18.6 packages, Ruby 3.3.0 and Ruby gems.
Each keeps its own license and its authors' copyright.

## OxideVM is separate software

The OxideVM engine that runs this image in a web browser is separate proprietary software of
Spacia B.V. It is not part of this image, it is not distributed in this set, and it is not covered
by any license listed here. Running the image in the engine does not change the license of any
program in the image; the programs and the engine are separate works distributed side by side.

## Open-source licenses prevail

The open-source licenses of the programs in this image prevail for those programs. Nothing in
Spacia's terms limits the rights they give you: you may use, study, modify and redistribute each
program under its own license. Spacia's image signature only authenticates this copy; you can build,
sign and run modified images with your own keys.

## Contents of this set

- `sbom.spdx.json`: SPDX 2.3 inventory; every image file with its SHA-256, attributed to exactly one package with a concluded license.
- `sbom.cdx.json`: CycloneDX 1.6 SBOM with every package of the image (also the APK meta or virtual entries that install no files: .ruby-rundeps, libc-utils), its license, purl and, for copyleft packages, the source download.
- `licenses/` (one file per license or exception) and `licenses/NOTICES.txt`: every package's license text, copyright and notice lines, collected from the upstream sources and installed files.
- `sources/<package>-<version>/`: the complete corresponding source of every package that carries source duties.
- `SHA256SUMS`: SHA-256 of every file in this set.

The same materials are published at https://github.com/spacia-ai/greenbar-sources/releases/tag/image-exercism-ruby-test-runner-v2026.11.01.

## Packages

| Package | Version | License | Files | Source |
| --- | --- | --- | --- | --- |
| alpine-baselayout | 3.4.3-r1 | `GPL-2.0-only` | 13 | [sources/alpine-baselayout-3.4.3-r1/](sources/alpine-baselayout-3.4.3-r1/) |
| alpine-baselayout-data | 3.4.3-r1 | `GPL-2.0-only` | 15 | [sources/alpine-baselayout-3.4.3-r1/](sources/alpine-baselayout-3.4.3-r1/) |
| alpine-keys | 2.4-r1 | `MIT` | 41 | notices only |
| alpine-release | 3.18.6-r0 | `MIT` | 4 | notices only |
| apk-tools | 2.14.0-r2 | `GPL-2.0-only` | 10 | [sources/apk-tools-2.14.0-r2/](sources/apk-tools-2.14.0-r2/) |
| ast | 2.4.2 | `MIT` | 9 | notices only |
| bash | 5.2.15-r5 | `GPL-3.0-or-later` | 38 | [sources/bash-5.2.15-r5/](sources/bash-5.2.15-r5/) |
| bundler | 2.5.3 | `MIT AND BSD-2-Clause` | 345 | notices only |
| busybox | 1.36.1-r5 | `GPL-2.0-only` | 297 | [sources/busybox-1.36.1-r5/](sources/busybox-1.36.1-r5/) |
| busybox-binsh | 1.36.1-r5 | `GPL-2.0-only` | 1 | [sources/busybox-1.36.1-r5/](sources/busybox-1.36.1-r5/) |
| bzip2 | 1.0.8-r5 | `bzip2-1.0.6` | 11 | notices only |
| ca-certificates | 20230506-r0 | `MPL-2.0 AND MIT` | 428 | [sources/ca-certificates-20230506-r0/](sources/ca-certificates-20230506-r0/) |
| ca-certificates-bundle | 20230506-r0 | `MPL-2.0 AND MIT` | 4 | [sources/ca-certificates-20230506-r0/](sources/ca-certificates-20230506-r0/) |
| debug | 1.9.1 | `BSD-2-Clause` | 39 | notices only |
| exercism-ruby-test-runner | 4dcaecc3fc5f | `AGPL-3.0-only` | 24 | [sources/exercism-ruby-test-runner-4dcaecc3fc5f/](sources/exercism-ruby-test-runner-4dcaecc3fc5f/) |
| gmp | 6.2.1-r3 | `LGPL-3.0-or-later` | 2 | [sources/gmp-6.2.1-r3/](sources/gmp-6.2.1-r3/) · [relink](sources/gmp-6.2.1-r3/RELINK-SPDXRef-Package-gmp.md) |
| gmp-dev | 6.2.1-r3 | `LGPL-3.0-or-later` | 8 | [sources/gmp-6.2.1-r3/](sources/gmp-6.2.1-r3/) · [relink](sources/gmp-6.2.1-r3/RELINK-SPDXRef-Package-gmp-dev.md) |
| json | 2.7.1 | `BSD-2-Clause AND LicenseRef-json-2.7.1` | 22 | in Ruby's source, [sources/ruby-3.3.0/](sources/ruby-3.3.0/) |
| json | 2.6.3 | `BSD-2-Clause AND LicenseRef-json-2.6.3` | 50 | notices only |
| libcrypto3 | 3.1.4-r5 | `Apache-2.0` | 14 | notices only |
| libffi | 3.4.4-r2 | `MIT` | 2 | notices only |
| libffi-dev | 3.4.4-r2 | `MIT` | 5 | notices only |
| libgcc | 12.2.1_git20220924-r10 | `GPL-3.0-or-later WITH GCC-exception-3.1` | 1 | [sources/gcc-12.2.1_git20220924-r10/](sources/gcc-12.2.1_git20220924-r10/) |
| libgmpxx | 6.2.1-r3 | `LGPL-3.0-or-later` | 2 | [sources/gmp-6.2.1-r3/](sources/gmp-6.2.1-r3/) · [relink](sources/gmp-6.2.1-r3/RELINK-SPDXRef-Package-libgmpxx.md) |
| libintl | 0.21.1-r7 | `LGPL-2.1-or-later` | 2 | [sources/gettext-0.21.1-r7/](sources/gettext-0.21.1-r7/) · [relink](sources/gettext-0.21.1-r7/RELINK-SPDXRef-Package-libintl.md) |
| libncursesw | 6.4_p20230506-r0 | `X11` | 2 | notices only |
| libproc2 | 4.0.4-r0 | `GPL-2.0-or-later AND LGPL-2.1-or-later` | 2 | [sources/procps-ng-4.0.4-r0/](sources/procps-ng-4.0.4-r0/) · [relink](sources/procps-ng-4.0.4-r0/RELINK-SPDXRef-Package-libproc2.md) |
| libssl3 | 3.1.4-r5 | `Apache-2.0` | 2 | notices only |
| libstdc++ | 12.2.1_git20220924-r10 | `GPL-3.0-or-later WITH GCC-exception-3.1` | 2 | [sources/gcc-12.2.1_git20220924-r10/](sources/gcc-12.2.1_git20220924-r10/) |
| linux-headers | 6.3-r0 | `GPL-2.0-only WITH Linux-syscall-note AND BSD-3-Clause AND GPL-1.0-or-later WITH Linux-syscall-note AND GPL-2.0-or-later WITH Linux-syscall-note AND LGPL-2.0-or-later WITH Linux-syscall-note AND LGPL-2.1-only WITH Linux-syscall-note AND LGPL-2.1-or-later WITH Linux-syscall-note AND MIT` | 948 | [sources/linux-headers-6.3-r0/](sources/linux-headers-6.3-r0/) · [relink](sources/linux-headers-6.3-r0/RELINK-SPDXRef-Package-linux-headers.md) |
| mandate | 1.0.0 | `MIT` | 25 | notices only |
| matrix | 0.4.2 | `BSD-2-Clause` | 7 | notices only |
| minitest | 5.11.3 | `MIT` | 28 | notices only |
| minitest | 5.20.0 | `MIT` | 30 | notices only |
| musl | 1.2.4-r2 | `MIT` | 2 | notices only |
| musl-utils | 1.2.4-r2 | `MIT AND BSD-2-Clause AND GPL-2.0-or-later` | 5 | [sources/musl-1.2.4-r2/](sources/musl-1.2.4-r2/) |
| ncurses-terminfo-base | 6.4_p20230506-r0 | `X11` | 41 | notices only |
| net-ftp | 0.3.3 | `BSD-2-Clause` | 7 | notices only |
| net-imap | 0.4.9 | `BSD-2-Clause` | 49 | notices only |
| net-pop | 0.1.2 | `BSD-2-Clause` | 7 | notices only |
| net-smtp | 0.4.0 | `BSD-2-Clause` | 10 | notices only |
| nkf | 0.1.3 | `BSD-2-Clause AND Zlib AND LicenseRef-nkf-0.1.3` | 3 | in Ruby's source, [sources/ruby-3.3.0/](sources/ruby-3.3.0/) |
| parser | 3.3.0.5 | `MIT` | 84 | notices only |
| pkgconf | 1.9.5-r0 | `ISC` | 6 | notices only |
| power_assert | 2.0.3 | `BSD-2-Clause` | 16 | notices only |
| prime | 0.1.2 | `BSD-2-Clause` | 9 | notices only |
| procps-ng | 4.0.4-r0 | `GPL-2.0-or-later AND LGPL-2.1-or-later` | 16 | [sources/procps-ng-4.0.4-r0/](sources/procps-ng-4.0.4-r0/) · [relink](sources/procps-ng-4.0.4-r0/RELINK-SPDXRef-Package-procps-ng.md) |
| racc | 1.7.3 | `BSD-2-Clause` | 37 | notices only |
| rake | 13.1.0 | `MIT` | 62 | notices only |
| rbs | 3.4.0 | `BSD-2-Clause` | 470 | notices only |
| readline | 8.2.1-r1 | `GPL-3.0-or-later` | 3 | [sources/readline-8.2.1-r1/](sources/readline-8.2.1-r1/) |
| rexml | 3.2.6 | `BSD-2-Clause` | 68 | notices only |
| rss | 0.3.0 | `BSD-2-Clause` | 49 | notices only |
| rubocop-ast | 1.31.1 | `MIT` | 99 | notices only |
| ruby | 3.3.0 | `BSD-2-Clause AND BSD-3-Clause AND MIT AND CC0-1.0 AND Zlib AND Ruby-pty AND dtoa AND OFL-1.1 AND Unicode-TOU AND GPL-3.0-or-later WITH Bison-exception-2.2 AND Apache-2.0 WITH LLVM-exception` | 1474 | [sources/ruby-3.3.0/](sources/ruby-3.3.0/) |
| scanelf | 1.3.7-r1 | `GPL-2.0-only` | 1 | [sources/pax-utils-1.3.7-r1/](sources/pax-utils-1.3.7-r1/) |
| ssl_client | 1.36.1-r5 | `GPL-2.0-only` | 1 | [sources/busybox-1.36.1-r5/](sources/busybox-1.36.1-r5/) |
| test-unit | 3.6.1 | `BSD-2-Clause AND PSF-2.0` | 66 | notices only |
| typeprof | 0.21.9 | `MIT` | 30 | notices only |
| yaml | 0.2.5-r1 | `MIT` | 2 | notices only |
| yaml-dev | 0.2.5-r1 | `MIT` | 3 | notices only |
| zlib | 1.2.13-r1 | `Zlib` | 2 | notices only |
| zlib-dev | 1.2.13-r1 | `Zlib` | 4 | notices only |

## Corresponding source

Every package under GPL, LGPL, MPL or AGPL terms has its complete corresponding source in `sources/`:
for Alpine packages the exact aports recipe directory at the commit Alpine built it from (APKBUILD,
every patch and extra file) and the original upstream archives, each verified against the recipe's
SHA-512 checksums; for the Exercism runner a `git archive` of the commit, Dockerfile included;
for Ruby the release archive, the two patches and the docker-library Dockerfile.
Each kit has a `BUILD.md` with the rebuild steps and a `SHA256SUMS`. The sources are kept for as long as the image is offered.

## Libraries under the LGPL

Packages with LGPL terms are shipped as separate files, and nothing in the image links their code statically: gmp, gmp-dev, libgmpxx, libintl, libproc2, linux-headers, procps-ng. gmp, libgmpxx, libintl, libproc2 are shared libraries: relinking works by replacing the `.so` file. Rebuild the library from its source kit and put it in place of the shipped file; every program that uses it loads it at run time. procps-ng contains executables that load their LGPL libraries dynamically; they can be modified and rebuilt from their complete source. gmp-dev, linux-headers contain only headers and link files, so there is nothing to relink. Each relink note (`RELINK-*.md` in the package's source directory) lists the SONAMEs and every file that loads them.

## Notes

- Spacia did not modify any program in this image and did not build any of its binaries.
- License conclusions record the selected branch of every `OR` choice and the evidence for every correction of a distribution label in the SPDX package comments and in `NOTICES.txt`.
- Packages under a package-specific grant: json 2.6.3 (`LicenseRef-json-2.6.3`), json 2.7.1 (`LicenseRef-json-2.7.1`), nkf 0.1.3 (`LicenseRef-nkf-0.1.3`). Each grant's text is the package's complete notice and is published under the grant's name (`<grant>.txt`) in `licenses/`; the reasoning for the package's conclusion is in its SPDX `licenseComments`.
- Where a package ships no copyright notice, the notices say so; no attribution was invented.