Third-party notices
Version 2026-09-21 · Components in SuperDRM and what they are licensed under.
SuperDRM is built on open-source software. This page lists the components we ship or run, their licences, and how to get their source. The authoritative, complete list for a given build is that build's package-lock.json and the package manifests of the container images; the table below names the ones that matter.
Runtime components
| Component | Licence | Where |
|---|---|---|
| Node.js | MIT (with the bundled OpenSSL and other components under their own terms) | Every service |
Hono, @hono/node-server | MIT | API, docs, live, KSM sidecar |
pg (node-postgres) | MIT | API |
PGlite (@electric-sql/pglite) | Apache-2.0 | API — the embedded database |
| PostgreSQL | PostgreSQL Licence | Database (managed, and inside PGlite) |
| esbuild | MIT | Build tooling for docs, live and the player |
| tsx, TypeScript | MIT / Apache-2.0 | Build and runtime tooling |
| Next.js, React, React DOM | MIT | Operator console |
| marked, Shiki | MIT | Documentation site |
| pkcs11js | MIT | API — the PKCS#11 hardware vault |
| Shaka Player | Apache-2.0 | Loaded by the demo player in the browser; not redistributed by us |
| IBM Plex Sans, IBM Plex Mono | SIL Open Font License 1.1 | Self-hosted on every SuperDRM site (/fonts/) |
The Live image: FFmpeg and GPAC
The superdrm-live container image installs two packages from the Ubuntu archive to build and package the demo clip:
- FFmpeg — licensed under the GNU General Public License, version 2 or later as built and distributed by Ubuntu (some configurations are LGPL; the Ubuntu build is GPL).
- GPAC (the
MP4Boxtool) — licensed under the GNU Lesser General Public License, version 2.1 or later.
Neither is modified by us. They are installed unchanged from the Ubuntu 24.04 archive and invoked as separate programs; SuperDRM's own code is not a derivative work of either.
Written offer for source code. For any binary of FFmpeg or GPAC distributed in a SuperDRM container image, we will provide — for a period of three years from the date we distributed that image, to anyone who asks — a complete machine-readable copy of the corresponding source code, on a medium customarily used for software interchange, for no more than our cost of physically performing the distribution. Write to [email protected] [confirm], naming the image tag. The same source is available from the Ubuntu archive: apt-get source ffmpeg and apt-get source gpac on Ubuntu 24.04, or archive.ubuntu.com.
Licence texts
The full text of each licence ships with the component, in its package directory (node_modules/<name>/LICENSE) and, for the Debian/Ubuntu packages, in /usr/share/doc/<package>/copyright inside the image. The SIL Open Font License text for IBM Plex is at /fonts/LICENSE-OFL.txt. The same notice ships in the images as /app/NOTICE.
Trademarks
Widevine is a trademark of Google LLC. FairPlay is a trademark of Apple Inc. PlayReady is a trademark of Microsoft Corporation. IBM, IBM Cloud and IBM Plex are trademarks of International Business Machines Corporation. All other marks belong to their owners. Their use here names the technologies SuperDRM integrates with and implies no endorsement or affiliation.