# License Compliance Summary – UT Project

**Project:** UT
**Target:** TQMa6UL Yocto BSP (spaetzle/musl)
**Date:** 2026-03-01
**Data Source:** `bitbake -e` extraction, 264 packages
**Full Table:** [UT-license-table.csv](UT-license-table.csv)

---

## License Categories

### Approved for Military Use (✅)

| License | Type | Count | Notes |
|---------|------|-------|-------|
| MIT | Permissive | 41 | No restrictions |
| BSD-2-Clause | Permissive | 7 | No restrictions |
| BSD-3-Clause | Permissive | 19 | No restrictions |
| Apache-2.0 | Permissive | 2 | Patent grant included |
| GPL-2.0-only | Copyleft | 32 | Source must be provided |
| GPL-2.0-or-later | Copyleft | 22 | Source must be provided |
| LGPL-2.1-only | Weak Copyleft | 8 | Library source required |
| LGPL-2.1-or-later | Weak Copyleft | 6 | Library source required |

### Requires Legal Review (⚠️)

| License | Count | Reason |
|---------|-------|--------|
| GPL-3.0-only | 11 | Anti-tivoization clause |
| GPL-3.0-or-later | 13 | Anti-tivoization clause |
| Proprietary | 2 | Closed source (NXP firmware) |

### Build-Only (Not in Final Product)

Native/cross-build tools (GCC, CMake, Python, etc.) are only used during
compilation and are NOT deployed to the target device.

---

## Key Packages (verified from CSV)

### Core System

| Package | Version | License | In Image |
|---------|---------|---------|----------|
| linux-tq | 6.6.102+git | GPL-2.0-only | ✅ |
| u-boot-tq | 2023.04 | GPL-2.0-or-later | ✅ |
| musl | 1.2.4+git | MIT | ✅ |
| busybox | 1.36.1 | GPL-2.0-only | ✅ |

### Network & Security

| Package | Version | License | In Image |
|---------|---------|---------|----------|
| openssl | 3.2.4 | Apache-2.0 | ✅ |
| openssh | 9.6p1 | BSD-2/3-Clause & ISC & MIT | ✅ |
| dropbear | 2022.83 | MIT & BSD | ✅ |
| iptables | 1.8.10 | GPL-2.0-or-later | ✅ |
| iproute2 | 6.7.0 | GPL-2.0-or-later | ✅ |

### Utilities

| Package | Version | License | In Image |
|---------|---------|---------|----------|
| util-linux | 2.39.3 | GPL/LGPL/BSD mixed | ✅ |
| coreutils | 9.4 | GPL-3.0-or-later | ⚠️ Review |
| bash | 5.2.21 | GPL-3.0-or-later | ⚠️ Review |
| e2fsprogs | 1.47.0 | GPL-2.0 & BSD & MIT | ✅ |
| mtd-utils | 2.1.6 | GPL-2.0-or-later | ✅ |

### Proprietary (Review Required)

| Package | Version | License | Notes |
|---------|---------|---------|-------|
| firmware-imx | 8.27 | Proprietary (NXP SLA) | NXP firmware blobs |
| firmware-nxp-wifi | 1.1 | Proprietary (NXP) | WiFi firmware |
| linux-firmware | 20240909 | Mixed (70+ vendor licenses)¹ | Various vendor firmware blobs |

> **Note:** `imx-gpu-viv`, `imx-vpu`, `systemd` are NOT in this build
> (spaetzle/musl does not include GPU drivers or systemd).
>
> ¹ The `linux-firmware` package contains firmware blobs from 70+ hardware
> vendors (AMD, Intel, Broadcom, NXP, Realtek, etc.). Each blob has its own
> license — see the [CSV](UT-license-table.csv) column "License" for the
> complete list or the `WHENCE` file in the package for details.

---

## Compliance Checklist

- [x] All 264 packages identified with license (CSV)
- [x] Download URLs resolved for 224 packages (85%)
- [x] Proprietary components identified (2 packages)
- [ ] GPL-3.0 anti-tivoization clause reviewed by legal
- [ ] NXP firmware license terms verified for deployment use
- [ ] License manifest generated from actual build output

---

**Author:** Siggi ⚙️