Third-party licences

DFIRe is built using open source software. This page lists the third-party libraries and their licenses.

License Summary

DFIRe uses only open source libraries with licenses that permit commercial use. The following license types are used by our dependencies. Every build checks each Python and npm package, and each system library that DFIRe loads, against this table, and fails on any other license. A reviewer checks each program in the container image that DFIRe runs as a separate process (see the Container Image Note).

License Type Commercial Use
MIT Permissive Allowed
BSD (2-Clause, 3-Clause) Permissive Allowed
Apache 2.0 Permissive Allowed
ISC Permissive Allowed
MIT-CMU Permissive Allowed
BlueOak-1.0.0 Permissive Allowed
Unlicense Public domain Allowed
MPL 2.0 Weak Copyleft Allowed (see note below)
LGPL (2.1 / 3.0) Weak Copyleft Allowed (see note below)
RSALv2 / SSPLv1 Source Available Allowed (see note below)
PSF (Python) Permissive Allowed
PostgreSQL License Permissive Allowed
ZPL 2.1 Permissive Allowed
MIT-0, 0BSD Permissive Allowed
CC0 1.0 Public domain Allowed
CC BY 4.0 Attribution Allowed (data files)
CNRI-Python, TCL Permissive Allowed
FreeType License, libpng 2.0, HPND (sell variant) Permissive Allowed
SIL Open Font License 1.1, Bitstream Vera Font license Allowed (fonts)
GPL 3.0 with the GCC Runtime Library Exception Runtime library exception Allowed (see note below)

LGPL Note: The psycopg2 PostgreSQL driver is licensed under LGPL 3.0 and the paramiko SSH/SFTP library under LGPL 2.1. Pyphen, which WeasyPrint uses, is offered under GPL, LGPL or MPL 1.1, and DFIRe uses it under LGPL 2.1 or later. The PDF renderer also loads system libraries under LGPL: Pango, GLib, FriBidi, libthai, libdatrie and Graphite. Under LGPL terms, you may use these libraries in commercial applications without releasing your own source code, provided you do not modify the libraries themselves. DFIRe uses all of them as unmodified dependencies.

MPL 2.0 Note: mozilla-django-oidc and DOMPurify are licensed under MPL 2.0 (DOMPurify is dual-licensed Apache-2.0/MPL-2.0), as are the transitive dependencies certifi and tqdm. MPL 2.0 is a file-level copyleft license: modifications to MPL-licensed source files must be made available, but it does not require disclosure of surrounding proprietary code. DFIRe uses these libraries as unmodified dependencies.

Redis Note: DFIRe ships Redis 8, which the Redis project offers under your choice of RSALv2, SSPLv1 or AGPLv3. RSALv2 permits using Redis as a component in commercial software. It only restricts offering Redis itself as a competing managed database service. DFIRe uses Redis as an internal caching and message broker component, which is fully permitted under these terms.

Pyphen Note: Pyphen ships hyphenation dictionaries from LibreOffice under several licenses, some of them GPL. DFIRe never hyphenates text, so the backend image does not include these dictionaries. The Pyphen library code is not changed.

Container Image Note: The backend image is built on the official Python image, which is based on Debian. Some programs in the image use the GPL. The GnuPG tools verify a package key while the image is built. Perl runs the PostgreSQL client wrapper scripts. Some Debian helper tools are also GPL. DFIRe runs these programs as separate processes or not at all, and does not link to them. The GPL applies to those programs only. GLib loads libatomic from GCC, which is licensed under GPL 3.0 with the GCC Runtime Library Exception. The exception permits any program to use the library.

Backend Dependencies (Python)

The DFIRe backend is built with Python and uses the following key libraries:

Web Framework

Package License Purpose
Django BSD-3-Clause Web framework
Django REST Framework BSD-3-Clause REST API
drf-spectacular BSD-3-Clause OpenAPI schema generation
django-cors-headers MIT CORS handling
django-filter BSD-3-Clause QuerySet filtering
Django Channels BSD-3-Clause WebSocket support
Daphne BSD-3-Clause ASGI server
Gunicorn MIT WSGI server
WhiteNoise MIT Static file serving

Database & Caching

Package License Purpose
psycopg2 LGPL-3.0 PostgreSQL driver
dj-database-url BSD-3-Clause Database URL configuration
redis-py MIT Redis client
django-redis BSD-3-Clause Django cache backend for Redis
channels_redis BSD-3-Clause Redis channel layer for Channels
Django-Q2 MIT Background task queue

Security & Authentication

Package License Purpose
cryptography Apache-2.0 / BSD Encryption primitives
mozilla-django-oidc MPL-2.0 OpenID Connect authentication
PyJWT MIT JSON Web Token handling
pyOpenSSL Apache-2.0 TLS/SSL support
Bleach Apache-2.0 HTML sanitization
django-otp Unlicense Multi-factor authentication devices
Segno BSD-3-Clause QR codes for authenticator enrolment

Storage & Cloud

Package License Purpose
boto3 Apache-2.0 AWS/S3-compatible storage
django-storages BSD-3-Clause Storage backend abstraction
smbprotocol MIT SMB/CIFS file sharing
paramiko LGPL-2.1 SSH/SFTP file transfer

Data Processing

Package License Purpose
Pillow MIT-CMU Image processing
python-magic MIT File type detection
Requests Apache-2.0 HTTP client
PyYAML MIT YAML parsing
python-dotenv BSD-3-Clause Environment configuration
python-whois MIT WHOIS lookups for IOC enrichment
dnspython ISC DNS lookups for IOC enrichment

PDF Rendering

Package License Purpose
WeasyPrint BSD-3-Clause Renders the case report as PDF
pydyf BSD-3-Clause PDF writer (via WeasyPrint)
cssselect2 BSD-3-Clause CSS selectors (via WeasyPrint)
tinyhtml5 MIT HTML parser (via WeasyPrint)
fontTools MIT Font subsetting (via WeasyPrint)
Pyphen LGPL-2.1-or-later Hyphenation API (via WeasyPrint), without dictionaries

Integrations

Package License Purpose
jira BSD-3-Clause Jira integration
Slack Bolt MIT Slack integration
LiteLLM MIT LLM API abstraction
google-auth Apache-2.0 Google Vertex AI service-account authentication

Transitive Dependencies

The following notable libraries are included as transitive dependencies (pulled in by the packages above):

Package License Purpose
Twisted MIT Async networking (via Daphne)
Autobahn MIT WebSocket implementation (via Daphne)
zope.interface ZPL-2.1 Interface definitions (via Twisted)
Pydantic MIT Data validation (via LiteLLM)
HTTPX BSD-3-Clause Async HTTP client (via LiteLLM)
openai Apache-2.0 OpenAI API client (via LiteLLM)
tiktoken MIT LLM token counting (via LiteLLM)
huggingface_hub, tokenizers Apache-2.0 Tokenizer support (via LiteLLM)

Frontend Dependencies (JavaScript)

The DFIRe frontend is a React single-page application using the following libraries:

Core Framework

Package License Purpose
React MIT UI framework
React Router MIT Client-side routing
TanStack Query MIT Server state management

Styling & UI

Package License Purpose
Tailwind CSS MIT Utility-first CSS framework
Lucide React ISC Icon library
Recharts MIT Charting library
focus-trap-react MIT Keyboard focus handling in dialogs

Data & HTTP

Package License Purpose
Axios MIT HTTP client
date-fns MIT Date manipulation

Content & Security

Package License Purpose
DOMPurify Apache-2.0 / MPL-2.0 HTML sanitization
react-markdown MIT Markdown rendering
remark-gfm MIT GitHub Flavored Markdown support
rehype-sanitize MIT HTML sanitization for Markdown
PrismJS MIT Syntax highlighting
react-simple-code-editor MIT Code editor component
hash-wasm MIT SHA-256 in the browser for Direct Storage uploads

Build Tools

Package License Purpose
Vite MIT Build tool & dev server
TypeScript Apache-2.0 Type checking
ESLint MIT Code linting
Vitest MIT Testing framework

Runtime Dependencies

DFIRe runs on the following open source infrastructure components:

Component License Purpose
Python PSF License Backend runtime
Node.js MIT Frontend build
PostgreSQL PostgreSQL License Database
Redis RSALv2 / SSPLv1 / AGPLv3 Caching & message broker
Nginx BSD-2-Clause Web server (production)

System Packages in the Backend Image

The backend image adds these Debian packages, and the libraries they need, to the official Python image. The source of every Debian package is available from the Debian archive.

Component License Purpose
Pango LGPL-2.0-or-later Text layout for the report PDF
HarfBuzz MIT Text shaping and font subsetting
GLib LGPL-2.1-or-later Utility library (via Pango)
FreeType FreeType License Font rendering
fontconfig HPND (sell variant) Font matching
FriBidi, libthai, libdatrie, Graphite LGPL-2.1-or-later Bidirectional and complex script text
libpng libpng 2.0 PNG decoding (via FreeType)
libmagic BSD-2-Clause File type detection
PostgreSQL client tools PostgreSQL License Backup and restore
curl curl License Container health check
GnuPG GPL-3.0-or-later Verifies the PostgreSQL package key while the image is built
Perl Artistic License or GPL Runs the PostgreSQL client wrapper scripts

Fonts

Font License Purpose
Inter SIL OFL 1.1 Typeface of the web interface and the report PDF
DejaVu Bitstream Vera Monospace text and symbols in the report PDF

License Compliance

DFIRe complies with all license requirements of its dependencies:

  • Attribution: This page provides attribution as required by BSD, MIT, and Apache licenses.
  • Source availability: All dependencies are available from their respective package registries (PyPI, npm) or source repositories.
  • No modification: DFIRe uses all dependencies as unmodified libraries, satisfying LGPL and MPL requirements without source disclosure obligations. The build only deletes Pyphen's hyphenation dictionaries and leaves its code as published.
  • Automated check: Every build compares the license of each Python and npm package, and of each system library that DFIRe loads, with the License Summary table. A package with any other license stops the build. A new system package of any kind also stops the build until someone reviews it.
  • Redis usage: DFIRe uses Redis as an internal infrastructure component (caching and message broker), which is permitted under the RSALv2 license terms.
  • License texts: Full license texts are included in the respective packages and available from the links above.

Questions? If you have questions about licensing or need additional compliance documentation, please contact us at [email protected].