Licensing hygiene: third-party attribution + GPLv3 compliance for published images

[VijitSingh97]

Summary

The repo is MIT-licensed, and that's the right choice — but two licensing-hygiene gaps should be closed so the MIT claim is correct, not just probably fine. Neither is urgent (no copyleft is infecting our code), so targeting v1.1.

Background: We bundle two GPLv3 components — p2pool and xmrig-proxy. Both enter as version-pinned, sha256-verified upstream binaries downloaded at image-build time and run as separate containers communicating over sockets/RPC. No GPL source is in our tree and nothing is linked into our code, so this is textbook GPLv3 "mere aggregation" — MIT for our orchestrator code is fine. Everything else we ship is permissive (monerod/Tor/Tari = BSD-3, Caddy/socket-proxy/Python deps = Apache-2.0/BSD, vendored JS = MIT except htm = Apache-2.0).

Gap 1 — LICENSE over-claims third-party files

LICENSE asserts MIT © Vijit Singh over "the Software," but the repo also redistributes files that are neither ours nor MIT:

• Tari .proto files + generated gRPC stubs under build/dashboard/mining_dashboard/client/tari/ — BSD-3-Clause, © The Tari Project
• build/dashboard/mining_dashboard/web/static/vendor/htm.module.js — Apache-2.0
• Other vendored JS (preact, chart.js, chartjs-plugin-zoom, hammerjs) — MIT (compatible, but should still be attributed)

This is an attribution gap, not a copyleft problem.

Fix:

• Add THIRD_PARTY_LICENSES.md (or NOTICE) enumerating bundled/vendored components and their licenses
• Scope the README "License" section + LICENSE to clarify MIT covers the project's original code; bundled/third-party files retain their own licenses

Gap 2 — We publish images containing GPLv3 binaries → GPLv3 §6 applies to those binaries

We push ghcr.io/p2pool-starter-stack/pithead-p2pool and …-xmrig-proxy, which contain the GPLv3 binaries. Whoever distributes a GPLv3 binary must provide the corresponding source (or a written offer / network access) plus the GPLv3 license text and copyright notices — independent of our repo's own license. Since we ship unmodified, version-pinned upstream binaries, compliance is low-effort: point to the exact upstream source for the pinned tag.

Fix:

• Include GPLv3 license text + upstream copyright notices alongside the p2pool/xmrig-proxy images (and/or in docs)
• Document a "corresponding source" pointer to the pinned upstream releases (the ARG *_VERSION + sha256 in each Dockerfile make this unambiguous)
• Add a short "Licensing & GPL compliance" section to docs

Out of scope / non-issues

• No GPL source is copied into the repo; no linking — orchestrator code stays MIT.
• monerod, Tor, Tari, Caddy, socket-proxy are permissive (no copyleft obligations beyond attribution, folded into Gap 1).

Not legal advice — engineering-informed reading of well-trodden GPLv3 aggregation principles. A quick counsel check before a major release wouldn't hurt.