Runner image third-party notices

The hosted runner image, the runner VM image it is baked into, fremforge development benches and fremforge’s scanners include third-party software and data. The notices below apply to each of them. This page gives the notices their licences require, the attribution for the data, and where to get the source code of the components whose licences require that.

The image carries the licence files itself as well:

• /usr/share/licenses/<component>/ for Node.js, the SAST rules and opengrep;
• /usr/share/doc/<package>/copyright for every Debian package;
• next to each module, for the modules bundled with Node.js and npm.

The complete component list of each image build is its CycloneDX SBOM; see Image size, cold-start, rebuild cadence.

opengrep

opengrep is at /usr/local/bin/opengrep in the runner image, the runner VM image and on development benches. Copyright the opengrep authors and Semgrep, Inc. It is licensed under the GNU Lesser General Public License, version 2.1: full text.

fremforge ships the upstream release binary unmodified. Run opengrep --version in a job to see the version in the image you are on (1.22.0 on 2026-10-26).

Source code. The complete corresponding source of every opengrep version fremforge ships (runner image, runner VM image, benches) is available from fremforge’s mirror of the upstream repository, at frem.sh/opengrep/opengrep, under the release tag of that version (for example v1.22.0). The mirror is readable by every signed-in frem.sh user.

Written offer. For at least three years after we last ship a given opengrep version, fremverk ApS will give anyone who asks a copy of the complete corresponding source code for that version, on a medium customarily used for software interchange, for no more than our cost of physically performing the distribution. Write to support@frem.sh and name the version.

SAST rules

The runner image ships the GitLab sast-rules language folders under /opt/sast-rules/. fremforge’s central SAST scanner uses the same folders.

• GitLab sast-rules: Copyright (c) GitLab Inc. MIT licence; the text is at /opt/sast-rules/LICENSE and /usr/share/licenses/sast-rules/LICENSE in the image.
• gosec: the rules in /opt/sast-rules/go are derived from gosec, Copyright (c) the gosec authors, and are licensed under the Apache License, Version 2.0: full text, also at /usr/share/licenses/sast-rules/go-gosec-Apache-2.0 in the image.
• 0xdea semgrep-rules (central scanner only): Copyright (c) 2022 raptor (0xdea). MIT licence.

Node.js

The runner’s system Node.js is Node.js, Copyright Node.js contributors. It is licensed under the MIT licence. Node.js includes third-party components under their own licences, which are listed in its LICENSE file: at /usr/share/licenses/nodejs/LICENSE in the image and in the Node.js repository.

Scanners and supply-chain tools

The MIT licence: Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Advisory data

fremforge’s vulnerability and malicious-package findings use advisory data from the sources below, licensed under the Creative Commons Attribution 4.0 International licence (CC-BY-4.0). fremforge reformats and indexes the records to match them against your dependencies and images; it does not change what they say. The sources do not endorse fremforge.

• GitHub Advisory Database, GitHub, Inc.
• OSV, the OSV.dev contributors and the databases it aggregates.
• Go vulnerability database, the Go Authors.
• Red Hat security data, Red Hat, Inc.
• SUSE security data, SUSE LLC.
• The Trivy vulnerability databases (trivy-db, trivy-java-db), Aqua Security Software Ltd., compile records from these and other sources. The database build is Apache-2.0; the GitHub Advisory Database, Red Hat and SUSE records in it are CC-BY-4.0, credited above.

The data is provided as is, without warranty of any kind. Records in OSV and in the Trivy databases keep the terms of the source they come from.

Malware signatures

The malware scan uses ClamAV with these signature sources:

• YARA-Forge Core: rule packages compiled by YARA-Forge from public YARA rule repositories, each rule credited to its authors in its metadata. Licensed under the Detection Rule License 1.1.
• SaneSecurity signatures, used under SaneSecurity’s terms.
• Linux Malware Detect signatures, R-fx Networks, GPLv2.