dash (sh)
  licence: BSD-3-Clause (some files carry other licences; see the Debian copyright file)
  source:  http://gondor.apana.org.au/~herbert/dash/
  why:     The POSIX shell orgfs is tested under; small, strict, no bashisms.

busybox (ash)
  licence: GPL-2.0-only
  source:  https://busybox.net/license.html
  why:     A second small shell and set of utilities, so we know orgfs does not lean on GNU extras.

gawk
  licence: GPL-3.0-or-later
  source:  https://www.gnu.org/software/gawk/
  why:     One of the two awks the declaration parser and site renderer are tested under.

mawk
  licence: GPL-2.0-only
  source:  https://invisible-island.net/mawk/
  why:     The other tested awk; its smaller feature set keeps the awk code portable.

GNU coreutils
  licence: GPL-3.0-or-later
  source:  https://www.gnu.org/software/coreutils/
  why:     sha256sum, dd, sort, cut, tr, wc and cp do the byte work.

GNU make
  licence: GPL-3.0-or-later
  source:  https://www.gnu.org/software/make/
  why:     Runs the check, prove-red, site and demo targets.

git
  licence: GPL-2.0-only (some files LGPL-2.1-or-later or permissive)
  source:  https://git-scm.com/about/free-and-open-source
  why:     Holds the history of this project and its declarations.

Python 3 (tests only)
  licence: PSF-2.0
  source:  https://docs.python.org/3/license.html
  why:     Drives the black-box tests from a second language; the tool itself needs no Python.

nginx
  licence: BSD-2-Clause
  source:  https://nginx.org/LICENSE
  why:     Serves the static site.

dehydrated
  licence: MIT
  source:  https://github.com/dehydrated-io/dehydrated
  why:     Obtains and renews the site certificate.

OpenSSH (sshfs transport)
  licence: BSD-style, several variants (see the LICENCE file in the OpenSSH source)
  source:  https://github.com/openssh/openssh-portable/blob/master/LICENCE
  why:     Carries the remote mounts that the sshfs transport reads and writes through.

sshfs
  licence: unchecked
  source:  https://github.com/libfuse/sshfs
  why:     Provides the mounts under /spokes; licence not yet confirmed from its own source.

Debian GNU/Linux
  licence: Mixed: every package carries its own DFSG-free licence
  source:  https://www.debian.org/legal/licenses/
  why:     The operating system the hosts run; its packages are the ones listed above.

Proxmox VE
  licence: unchecked (believed AGPL-3.0)
  source:  https://www.proxmox.com/
  why:     The hypervisor under the hosts; exact licence version wording not yet confirmed.

GitHub Actions runner
  licence: MIT
  source:  https://github.com/actions/runner
  why:     Runs the CI on a machine we host.

actions/checkout
  licence: MIT
  source:  https://github.com/actions/checkout
  why:     Fetches the source in CI.