# NAPP Stack — Bundled Component Licenses

NAPP Stack **orchestrates** the programs below as separate processes. They are
**not** part of the NAPP binary and keep their own licenses. Because NAPP mirrors
their official builds on its distribution host, NAPP redistributes them and
therefore ships each component's license and — for GPL components — a written
offer of source code.

Versions reflect the current bundled manifest (`napp components check` shows what
is installed on this machine; the canonical per-artifact data, including
`license` and `source_url`, lives in the component manifest).

| Component | Bundled version | License (SPDX) | Type | Upstream |
|---|---|---|---|---|
| Nginx | 1.31.1 | BSD-2-Clause | Permissive | https://nginx.org/ |
| Apache HTTP Server | 2.4.67 | Apache-2.0 | Permissive | https://httpd.apache.org/ |
| PHP | 8.5.7 / 8.4.22 | PHP-3.01 | Permissive | https://www.php.net/license/ |
| PostgreSQL | 18.4 | PostgreSQL (BSD-like) | Permissive | https://www.postgresql.org/about/licence/ |
| MariaDB Server | 11.8.8 | GPL-2.0-only | **Copyleft** | https://mariadb.com/kb/en/mariadb-license/ |
| Redis | 5.0.14 | BSD-3-Clause | Permissive | https://redis.io/ |
| Mailpit | 1.30.1 | MIT | Permissive | https://github.com/axllent/mailpit |
| Adminer (DB tool) | — | Apache-2.0 build | Permissive | https://www.adminer.org/ |

Notes:

- **MariaDB is GPL-2.0.** Because NAPP mirrors the MariaDB build, NAPP carries a
  written **GPLv2 §3(b) source offer** — see `MARIADB-SOURCE-OFFER.txt` — and
  hosts the corresponding source tarball on the mirror (referenced by the
  manifest `source_url`). This obligation rides along with the binary mirror; the
  NAPP binary itself stays proprietary (the GPL component runs as a separate
  process — "mere aggregation").
- **Adminer** is available under a dual Apache-2.0 / GPL-2.0 license. NAPP ships
  the **Apache-2.0** build specifically to avoid taking on a second GPL source
  obligation.
- Runtime-downloaded applications (WordPress, Laravel) and tools (Composer,
  WP-CLI) are fetched by the operator's machine from their own upstreams; NAPP
  does not redistribute them, so they are not listed here.

Full upstream license texts ship alongside this index in the `components/`
directory of the release bundle. Run `napp licenses --components` to print this
index from the binary.