# Open-source notice: exercism-sqlite-test-runner 2026.11.01

This is the source and license set for the OxideVM image **exercism-sqlite-test-runner** version **2026.11.01**:
the Exercism SQLite test runner, Docker image `docker.io/exercism/sqlite-test-runner@sha256:e7b773b763d46c60faaa4fb166de9467518ab6a2d715ac0e82ecb85d1695c816`,
converted into an OxideVM Userspace image **without modification**. All 508
non-directory entries of the image filesystem (regular files, symbolic links and hard links;
inventory SHA-256 `bda721136c1505e285f75f8bfd864143ec3df4838dd18b29a4e97bb9b91d6cff`) are byte-identical to the merged layers of
that Docker image. Nothing was added, removed or changed.

## Who made it

The test runner and its exercises are the work of [Exercism](https://exercism.org). The runner is
[github.com/exercism/sqlite-test-runner](https://github.com/exercism/sqlite-test-runner) at commit
`aa5ca3666b29f5b29f8a46a7cf5f5ae63d7f557c`, published by Exercism under the GNU Affero General Public License version 3.
Exercism built and published the Docker image. The image also contains 30 other packages,
listed below: Alpine Linux 3.24.3 packages.
Each keeps its own license and its authors' copyright.

## OxideVM is separate software

The OxideVM engine that runs this image in a web browser is separate proprietary software of
Spacia B.V. It is not part of this image, it is not distributed in this set, and it is not covered
by any license listed here. Running the image in the engine does not change the license of any
program in the image; the programs and the engine are separate works distributed side by side.

## Open-source licenses prevail

The open-source licenses of the programs in this image prevail for those programs. Nothing in
Spacia's terms limits the rights they give you: you may use, study, modify and redistribute each
program under its own license. Spacia's image signature only authenticates this copy; you can build,
sign and run modified images with your own keys.

## Contents of this set

- `sbom.spdx.json`: SPDX 2.3 inventory; every image file with its SHA-256, attributed to exactly one package with a concluded license.
- `sbom.cdx.json`: CycloneDX 1.6 SBOM with every package of the image, its license, purl and, for copyleft packages, the source download.
- `licenses/` (one file per license or exception) and `licenses/NOTICES.txt`: every package's license text, copyright and notice lines, collected from the upstream sources and installed files.
- `sources/<package>-<version>/`: the complete corresponding source of every package that carries source duties.
- `SHA256SUMS`: SHA-256 of every file in this set.

The same materials are published at https://github.com/spacia-ai/greenbar-sources/releases/tag/image-exercism-sqlite-test-runner-v2026.11.01.

## Packages

| Package | Version | License | Files | Source |
| --- | --- | --- | --- | --- |
| acl-libs | 2.3.2-r1 | `LGPL-2.1-or-later AND GPL-2.0-or-later` | 2 | [sources/acl-2.3.2-r1/](sources/acl-2.3.2-r1/) · [relink](sources/acl-2.3.2-r1/RELINK-SPDXRef-Package-acl-libs.md) |
| alpine-baselayout | 3.7.2-r1 | `GPL-2.0-only` | 13 | [sources/alpine-baselayout-3.7.2-r1/](sources/alpine-baselayout-3.7.2-r1/) |
| alpine-baselayout-data | 3.7.2-r1 | `GPL-2.0-only` | 15 | [sources/alpine-baselayout-3.7.2-r1/](sources/alpine-baselayout-3.7.2-r1/) |
| alpine-keys | 2.6-r0 | `MIT` | 41 | notices only |
| alpine-release | 3.24.3-r0 | `MIT` | 5 | notices only |
| apk-tools | 3.0.8-r0 | `GPL-2.0-only` | 9 | [sources/apk-tools-3.0.8-r0/](sources/apk-tools-3.0.8-r0/) |
| busybox | 1.37.0-r31 | `GPL-2.0-only` | 229 | [sources/busybox-1.37.0-r31/](sources/busybox-1.37.0-r31/) |
| busybox-binsh | 1.37.0-r31 | `GPL-2.0-only` | 1 | [sources/busybox-1.37.0-r31/](sources/busybox-1.37.0-r31/) |
| ca-certificates-bundle | 20261020-r0 | `MPL-2.0 AND MIT` | 4 | [sources/ca-certificates-20261020-r0/](sources/ca-certificates-20261020-r0/) |
| coreutils | 9.11-r0 | `GPL-3.0-or-later` | 100 | [sources/coreutils-9.11-r0/](sources/coreutils-9.11-r0/) |
| coreutils-env | 9.11-r0 | `GPL-3.0-or-later` | 1 | [sources/coreutils-9.11-r0/](sources/coreutils-9.11-r0/) |
| coreutils-fmt | 9.11-r0 | `GPL-3.0-or-later` | 1 | [sources/coreutils-9.11-r0/](sources/coreutils-9.11-r0/) |
| coreutils-sha512sum | 9.11-r0 | `GPL-3.0-or-later` | 1 | [sources/coreutils-9.11-r0/](sources/coreutils-9.11-r0/) |
| exercism-sqlite-test-runner | aa5ca3666b29 | `AGPL-3.0-only` | 5 | [sources/exercism-sqlite-test-runner-aa5ca3666b29/](sources/exercism-sqlite-test-runner-aa5ca3666b29/) |
| jq | 1.8.2-r0 | `MIT` | 3 | notices only |
| libapk | 3.0.8-r0 | `GPL-2.0-only` | 1 | [sources/apk-tools-3.0.8-r0/](sources/apk-tools-3.0.8-r0/) |
| libattr | 2.5.2-r2 | `LGPL-2.1-or-later` | 2 | [sources/attr-2.5.2-r2/](sources/attr-2.5.2-r2/) · [relink](sources/attr-2.5.2-r2/RELINK-SPDXRef-Package-libattr.md) |
| libcrypto3 | 3.5.9-r0 | `Apache-2.0` | 10 | notices only |
| libncursesw | 6.6_p20260516-r0 | `X11` | 2 | notices only |
| libssl3 | 3.5.9-r0 | `Apache-2.0` | 1 | notices only |
| musl | 1.2.6-r3 | `MIT` | 2 | notices only |
| musl-utils | 1.2.6-r3 | `MIT AND BSD-2-Clause AND GPL-2.0-or-later` | 5 | [sources/musl-1.2.6-r3/](sources/musl-1.2.6-r3/) |
| ncurses-terminfo-base | 6.6_p20260516-r0 | `X11` | 41 | notices only |
| oniguruma | 6.9.10-r0 | `BSD-2-Clause` | 2 | notices only |
| readline | 8.3.3-r1 | `GPL-3.0-or-later` | 3 | [sources/readline-8.3.3-r1/](sources/readline-8.3.3-r1/) |
| scanelf | 1.3.9-r1 | `GPL-2.0-only` | 1 | [sources/pax-utils-1.3.9-r1/](sources/pax-utils-1.3.9-r1/) |
| skalibs-libs | 2.15.0.0-r0 | `ISC` | 2 | notices only |
| sqlite | 3.53.4-r0 | `blessing` | 1 | [sources/sqlite-3.53.4-r0/](sources/sqlite-3.53.4-r0/) |
| ssl_client | 1.37.0-r31 | `GPL-2.0-only` | 1 | [sources/busybox-1.37.0-r31/](sources/busybox-1.37.0-r31/) |
| utmps-libs | 0.1.3.3-r0 | `ISC` | 2 | notices only |
| zlib | 1.3.2-r1 | `Zlib` | 2 | notices only |

## Corresponding source

Every package under GPL, LGPL, MPL or AGPL terms has its complete corresponding source in `sources/`:
for Alpine packages the exact aports recipe directory at the commit Alpine built it from (APKBUILD,
every patch and extra file) and the original upstream archives, each verified against the recipe's
SHA-512 checksums; for the Exercism runner a `git archive` of the commit, Dockerfile included;
for SQLite its Alpine recipe and archives, because its shell links GPL readline.
Each kit has a `BUILD.md` with the rebuild steps and a `SHA256SUMS`. The sources are kept for as long as the image is offered.

## Libraries under the LGPL

Packages with LGPL terms are shipped as separate files, and nothing in the image links their code statically: acl-libs, libattr. acl-libs, libattr are shared libraries: relinking works by replacing the `.so` file. Rebuild the library from its source kit and put it in place of the shipped file; every program that uses it loads it at run time. Each relink note (`RELINK-*.md` in the package's source directory) lists the SONAMEs and every file that loads them.

## Notes

- Spacia did not modify any program in this image and did not build any of its binaries.
- License conclusions record the selected branch of every `OR` choice and the evidence for every correction of a distribution label in the SPDX package comments and in `NOTICES.txt`.
- Where a package ships no copyright notice, the notices say so; no attribution was invented.