{
  "schemaVersion": 1,
  "evidenceId": "pos-v1.3.0-linux-deb-package-license",
  "testedAt": "2026-08-21T04:12:54.222Z",
  "product": "Posnic POS",
  "release": "v1.3.0",
  "sourceCommit": "b531ef4308c4dc3a25f250551a54fc5616e3b8d9",
  "scope": "Static package-content and pinned build-source inspection. This record distinguishes Posnic's source license from a bundled database dependency; it is not legal advice or a complete license-compliance audit.",
  "artifact": {
    "filename": "posnic_1.3.0_amd64.deb",
    "bytes": 179172868,
    "sha256": "6717d78e07596c3859e5de4954f73dd68523487e0dd1a732b6dbc1f7fb8346fc",
    "downloadUrl": "https://github.com/Posnic/POS/releases/download/v1.3.0/posnic_1.3.0_amd64.deb",
    "publishedHashMatched": true
  },
  "method": {
    "host": "Windows",
    "tools": [
      "bsdtar 3.8.4 / libarchive 3.8.4",
      "Node.js v24.19.0",
      "@electron/asar v4.3.0"
    ],
    "steps": [
      "Downloaded the official v1.3.0 amd64 DEB from the Posnic/POS release.",
      "Computed SHA-256 and compared it with the release checksum recorded in the product facts.",
      "Listed the DEB members, extracted data.tar.xz and inspected package paths related to licenses and MongoDB.",
      "Listed app.asar and extracted its LICENSE and THIRD-PARTY-NOTICES.md files.",
      "Compared the package observation with the immutable v1.3.0 build script and MongoDB's official licensing pages."
    ]
  },
  "observations": {
    "debMembers": [
      "debian-binary",
      "control.tar.xz",
      "data.tar.xz"
    ],
    "bundledDatabaseBinaryPath": "/opt/Posnic/resources/mongodb/bin/mongod",
    "applicationLicensePath": "/opt/Posnic/resources/app.asar/LICENSE",
    "applicationLicenseSha256": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0",
    "applicationLicense": "AGPL-3.0-only",
    "thirdPartyNoticePath": "/opt/Posnic/resources/app.asar/THIRD-PARTY-NOTICES.md",
    "thirdPartyNoticeSha256": "59c9bb6c725766fe18b62b45b0126aa241a68188fab6ce71168c8e18d36c20ad",
    "thirdPartyNoticeDatabaseVersion": "7.0.x",
    "buildScriptDatabaseVersion": "7.0.14",
    "bundledDatabaseLicense": "SSPL-1.0",
    "bundledDatabaseLicenseIsOsiApproved": false,
    "licenseBoundary": "Posnic's own source is AGPL-3.0-only. The release package also contains an unmodified MongoDB Community Server binary under SSPL-1.0; the licenses and covered components are distinct."
  },
  "sourceEvidence": {
    "posnicLicense": "https://github.com/Posnic/POS/blob/b531ef4308c4dc3a25f250551a54fc5616e3b8d9/LICENSE",
    "posnicThirdPartyNotices": "https://github.com/Posnic/POS/blob/b531ef4308c4dc3a25f250551a54fc5616e3b8d9/THIRD-PARTY-NOTICES.md",
    "mongodbBinaryBuildCheck": "https://github.com/Posnic/POS/blob/b531ef4308c4dc3a25f250551a54fc5616e3b8d9/scripts/check-mongodb-binaries.js",
    "mongodbVersionPin": "https://github.com/Posnic/POS/blob/b531ef4308c4dc3a25f250551a54fc5616e3b8d9/download-mongodb.bat",
    "releaseWorkflow": "https://github.com/Posnic/POS/blob/b531ef4308c4dc3a25f250551a54fc5616e3b8d9/.github/workflows/release.yml",
    "mongodbOfficialLicensing": "https://www.mongodb.com/legal/licensing/community-edition",
    "mongodbOfficialSsplFaq": "https://www.mongodb.com/legal/licensing/server-side-public-license/faq"
  },
  "limitations": [
    "The package was inspected statically on Windows and was not installed or executed on Linux.",
    "Only the v1.3.0 amd64 DEB was inspected directly; the Windows, macOS and AppImage artifacts require separate content inventories.",
    "The pinned release workflow shows platform-specific MongoDB binaries being fetched for every desktop build, but source configuration is not a substitute for inspecting each published artifact.",
    "The third-party notice states MongoDB 7.0.x while the immutable download script pins 7.0.14; this record preserves both statements rather than silently choosing one.",
    "This inspection did not classify every npm, Electron, Chromium, runtime or system-library license.",
    "No conclusion is made here about legal compliance, license compatibility or suitability for a particular distribution repository."
  ]
}