Repository navigation
Releases
Releases · otfabric/openadr-interop
v0.8.1
Date: 2026-11-07
Previous release: v0.8.0
Fixed
- Contract 1.5,
listen-webhook: docs/CONTAINER_CONTRACT.md now says thatstatusis the VTN's answer toPOST /subscriptions.own/go-openadrreported the 200 of theDELETEthat removes the subscription at the end; it now reports the 201 of the creation, ascbsigmadoes, and the tests of both adapters check it (#24). Theopenadr-interop-otfabricimage, outside the releases, is rebuilt with the fix.
Changed
- README.md describes the
cbsigmaVTN and client and the webhook scenario (listen-webhook) (#23).
The reference adapters, the contract version (1.5) and the fixtures do not change.
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.8.1 |
v0.2.8 | sha256:fa2c79c47714cee50b012aa951c1be59928812d889bbff5d6e2033a13a6b155e |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.8.1 |
2.4.2 | sha256:c1304a49eb3eb60ed8a9eb2812481ac8a8bc5a9644022ad22b610caa8e57f8d2 |
ghcr.io/otfabric/openadr-interop-openleadr301:v0.8.1 |
v0.1.4 | sha256:2113661296e4cd6535b7c0f175daa8f59e63fa6c29429f0e22d4ac41e2c77d96 |
ghcr.io/otfabric/openadr-interop-cbsigma:v0.8.1 |
v0.2.0 | sha256:289ec02fe983921ce729dc4227c353a167ca27510a3e5ae038bf643f352e8186 |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:fa2c79c47714cee50b012aa951c1be59928812d889bbff5d6e2033a13a6b155e
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:c1304a49eb3eb60ed8a9eb2812481ac8a8bc5a9644022ad22b610caa8e57f8d2
OPENADR_INTEROP_OPENLEADR301_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr301@sha256:2113661296e4cd6535b7c0f175daa8f59e63fa6c29429f0e22d4ac41e2c77d96
OPENADR_INTEROP_CBSIGMA_IMAGE=ghcr.io/otfabric/openadr-interop-cbsigma@sha256:289ec02fe983921ce729dc4227c353a167ca27510a3e5ae038bf643f352e8186manifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.8.0
Date: 2026-11-06
Previous release: v0.7.0
Added
cbsigma: cB-Sigma openadr v0.2.0 (Go, Apache-2.0), an independent OpenADR 3.1.0 stack in both roles, published asghcr.io/otfabric/openadr-interop-cbsigma. The server is its VTN (oadr3/vtn) with its own token endpoint and webhooks; the clients are its REST client (oadr3.APIClient), which checks a request body with the library'soadr3.CheckRequestbefore it is sent. It is a second client foropenleadrand a second server forelaadnl, and its VTN passes the 24 conformance scenarios. A bug of its VTN found on the way, a VEN that cannot read a targeted object by ID, is cB-Sigma/openadr#1, tracked in #19.go.modandgo.sumofadapters/cbsigmahold the pin;scripts/check-versions.shchecks that they and the Dockerfile agree, and the Upstream workflow follows the tags of cB-Sigma/openadr.- Contract 1.5, webhooks: the client operation
listen-webhook(featureclientWebhook) serves a receiver, subscribes with the library's client and waits for notifications.scripts/interop.shhas a webhook scenario: a VEN subscribes, Business Logic creates an event, and the VTN notifies the VEN's webhook with the subscription's bearer token.cbsigmahas it, and so doesown/go-openadr(with go-openadr'swebhook.Handler) from its next build. - Contract 1.5,
serverTargetsUnlock: the reading of targets of thecbsigmaVTN. For a VEN, the targets a request names unlock the targeted objects it was granted and narrow nothing: a search naming targets returns the untargeted objects too, and a targeted object is not found by ID, asGET /programs/{programID}has no parameter to name its target. Cases of either reading run against the servers that have it. - A case for
GET /notifiersof a VTN without MQTT.
Changed
- The workflow check of the event's start time accepts
+00:00as well asZ: OpenLEADR writes the former, and a client that hands over the VTN's JSON as it is (cbsigma) passes it on. elaadnlmoves to ElaadNL openadr3-client 2.4.2 (tag134ff74e), the latest release. Between 2.4.0 and 2.4.2 the packageopenadr3_clientis unchanged. Its dependencies moved: oauthlib 3.3.1 to 4.0.1 (the library now requires 4), paho-mqtt 2.2.0, pydantic 2.14.3, certifi 2026.10.23, and the transitive security updates of 2.4.1.requirements.txtwas regenerated with its hashes. The set of packages is the same, and the cross-stack results are those of 2.4.0.needsintests/cases.tsvtakesserver:!<feature>andclient:!<feature>: the case runs only where the feature is not declared.- The Own stack workflow runs the cross-stack self-test against the adapters of the harness release's Makefile, so a release that adds an adapter adds it there too.
The fixtures do not change.
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.8.0 |
v0.2.8 | sha256:8f5c8e55a31a50888d2eca6da6431734c32b589b5151c68e86ddb68076da171e |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.8.0 |
2.4.2 | sha256:48b02fd2cbef75282093804837330a681934c4473c6e6907862ea8f0b34a3a65 |
ghcr.io/otfabric/openadr-interop-openleadr301:v0.8.0 |
v0.1.4 | sha256:ce3c87d9a633ef90816a3bba5daf972a19013b501cc728a64445767e93de0256 |
ghcr.io/otfabric/openadr-interop-cbsigma:v0.8.0 |
v0.2.0 | sha256:626f3742826ba30d4b62775cd343653c7ed0633422af4676a61aa3975b9be4ab |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:8f5c8e55a31a50888d2eca6da6431734c32b589b5151c68e86ddb68076da171e
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:48b02fd2cbef75282093804837330a681934c4473c6e6907862ea8f0b34a3a65
OPENADR_INTEROP_OPENLEADR301_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr301@sha256:ce3c87d9a633ef90816a3bba5daf972a19013b501cc728a64445767e93de0256
OPENADR_INTEROP_CBSIGMA_IMAGE=ghcr.io/otfabric/openadr-interop-cbsigma@sha256:626f3742826ba30d4b62775cd343653c7ed0633422af4676a61aa3975b9be4abmanifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.7.0
Date: 2026-11-06
Previous release: v0.6.3
Added
own/go-openadr/and the manual workflow Own stack (go-openadr): go-openadr, OT Fabric's own stack, behind the container contract as a VTN and as its Business Logic and VEN clients, published asghcr.io/otfabric/openadr-interop-otfabric:<go-openadr version>and:latestfor others to test against. It is not an independent implementation (upstream.independentEngine: false) and not part of this or any release:manifest.jsondoes not list it.ADAPTER_IMAGE_<adapter>:scripts/smoke.sh,scripts/interop.shandscripts/conformance.shtake an image from outside the release set.
Changed
results.jsontakesindependent, and for an image outsideversions.yamlits revision, licence and upstream name, from what the image says of itself.- The R1 check of CI also names
openadrctl.
Fixed
scripts/interop.shwith more than one client adapter: a case that starts its own server read the object IDs of the previous server of the same name, so every client after the first was sent IDs that its server did not have (404, 409). The release set has one client and did not show it.
The reference adapters, the container contract and the fixtures do not change.
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.7.0 |
v0.2.8 | sha256:b782af8c20e450d50614718eb38de553933bd7bc754006edf5bc6a2a6dc20836 |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.7.0 |
2.4.0 | sha256:278b49a54d4388b7d2e03106e5e332cc3c2b8a65a9ad7edc02e78cf730b7655f |
ghcr.io/otfabric/openadr-interop-openleadr301:v0.7.0 |
v0.1.4 | sha256:9dce7b15fef59e5d9b8be0899ac7de5e93cff49aaa8258eec55ea64330200804 |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:b782af8c20e450d50614718eb38de553933bd7bc754006edf5bc6a2a6dc20836
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:278b49a54d4388b7d2e03106e5e332cc3c2b8a65a9ad7edc02e78cf730b7655f
OPENADR_INTEROP_OPENLEADR301_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr301@sha256:9dce7b15fef59e5d9b8be0899ac7de5e93cff49aaa8258eec55ea64330200804manifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.6.3
Date: 2026-11-01
Previous release: v0.6.2
Changed
- The
Releaseworkflow can be run by hand from the Actions tab with a patch, minor or major bump, and checks thatversions.yamland RELEASE.md name that version before anything is built. The adapters, the container contract and the fixtures do not change.
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.6.3 |
v0.2.8 | sha256:331f178d185537743fbda4b3d5cf9d03e629f41e5b1a7f0865ec1e07e6c7b3a3 |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.6.3 |
2.4.0 | sha256:9be3e2939563d74ff125120726dfec55bc207fc5527bee2ddd3964f8cca384c2 |
ghcr.io/otfabric/openadr-interop-openleadr301:v0.6.3 |
v0.1.4 | sha256:d8f50f88389b035fed014dc05249e804dd51215d62b7323b9d0a3f74c36585ea |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:331f178d185537743fbda4b3d5cf9d03e629f41e5b1a7f0865ec1e07e6c7b3a3
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:9be3e2939563d74ff125120726dfec55bc207fc5527bee2ddd3964f8cca384c2
OPENADR_INTEROP_OPENLEADR301_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr301@sha256:d8f50f88389b035fed014dc05249e804dd51215d62b7323b9d0a3f74c36585eamanifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.6.2
Date: 2026-10-31
Previous release: v0.6.1
Changed
- Policy 1.2: build output in
bin/andrelease/, and shared CI at v3.3.0.
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.6.2 |
v0.2.8 | sha256:a33ef8891b825754ce7f7447b861d23875e12406685ed8287ff424d668f6efa9 |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.6.2 |
2.4.0 | sha256:ac12b2a86d8b809b49cd4d7eb97da5b978f2cf17617bfe8044ed5c38f307957c |
ghcr.io/otfabric/openadr-interop-openleadr301:v0.6.2 |
v0.1.4 | sha256:073fc8b26309f8d1094d224767b3495adc938b6dcdf6a60b55100b8189536bd5 |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:a33ef8891b825754ce7f7447b861d23875e12406685ed8287ff424d668f6efa9
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:ac12b2a86d8b809b49cd4d7eb97da5b978f2cf17617bfe8044ed5c38f307957c
OPENADR_INTEROP_OPENLEADR301_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr301@sha256:073fc8b26309f8d1094d224767b3495adc938b6dcdf6a60b55100b8189536bd5manifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.6.1
Date: 2026-10-30
Previous release: v0.5.0 (v0.6.0 was never tagged; its notes are below and ship in this release)
Summary
The openleadr adapter moves from OpenLEADR v0.2.7 to v0.2.8. The container contract, the fixtures and openleadr301 do not change.
Changes
Changed
openleadr: OpenLEADR v0.2.8, commitd1523514.serverInvalidTokenIs401ofopenleadris now true: a bearer token the VTN did not issue is answered 401 (openleadr-rs#498). Conformance AUTH-003 passes and is no longer a known finding: 21 of 24 scenarios pass, with 3 known findings.conformance/known/openleadr.tsvis of v0.2.8, its permalinks at the commit of that release.
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.6.1 |
v0.2.8 | sha256:329b74350fd8c105bd9dd8eb9a6c3972b5bae813f588da1b02bd7d2e388e5175 |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.6.1 |
2.4.0 | sha256:6d8874990f2da1b737768e68f89ca3753a763c5f71a7655a98890c04cb79e331 |
ghcr.io/otfabric/openadr-interop-openleadr301:v0.6.1 |
v0.1.4 | sha256:e07c0b03ccb479dc9228612452bf5c6c9e7e4783d7d81a5b85b64039ef9db7f3 |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:329b74350fd8c105bd9dd8eb9a6c3972b5bae813f588da1b02bd7d2e388e5175
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:6d8874990f2da1b737768e68f89ca3753a763c5f71a7655a98890c04cb79e331
OPENADR_INTEROP_OPENLEADR301_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr301@sha256:e07c0b03ccb479dc9228612452bf5c6c9e7e4783d7d81a5b85b64039ef9db7f3manifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.5.0
Date: 2026-10-29
Summary
A reference server of OpenADR 3.0.1: openleadr301, OpenLEADR openleadr-rs
v0.1.4, the last release of OpenADR 3.0. Fixtures can be of either
revision, a new fixture baseline-301 is the baseline in 3.0.1, and a
client and a server are paired only when they share a revision. Contract
1.4 and fixture schema 1.1: additions, nothing a consumer of 1.3 has to
change.
Changes
Added
- The
openleadr301image,ghcr.io/otfabric/openadr-interop-openleadr301, for linux/amd64 and linux/arm64: OpenLEADR v0.1.4 (commit92f4ba12d34cee0458af5846f170996d0b31978f) with a private PostgreSQL, server role only,openadrVersions["3.0.1"]. No MQTT, no Multicast DNS, no notifiers. The VTN listens on port 3000 whatever it is told; the adapter forwards--port(default 8080) to it and refuses--port 3000. - The
baseline-301fixture: the clients ofbaselinewith the same IDs and secrets, its ven, resource, programs and events, with targets as valuesMap objects. The targeted program and event nameVEN_NAMEsite-1. "3.0.1"inopenadrVersionsof the capability schema, and inopenadrVersionof the fixture schema, whose targets are strings in 3.1.0 and valuesMap objects in 3.0.1.make smokechecks of a 3.0.1 server (a token from/auth/token, valuesMap targets, a targeted program seen only by its VEN), and of every adapter refusing a fixture of a revision it does not serve or speak.
Changed
- Every adapter refuses a fixture of a revision it does not serve: exit 4 for
server, a usage error (exit 2) forclient. Theopenleadrandelaadnlimages serve and speak 3.1.0 only, as before. make interoppairs a client with a server only when they share an OpenADR version, and logs each pairing and each pair it leaves out.elaadnl→openleadr301is left out: 3.1.0 against 3.0.1.- The conformance suite stays of 3.1.0 and runs against
openleadronly: it asserts the 3.1.0 OpenAPI document, which 3.0.1 differs from in the shape of every targeted object. - The weekly candidate probe covers
openleadr301, following v0.1.x tags only.
Fixed
- docs/COMPATIBILITY.md and the
elaadnladapter said that ElaadNL openadr3-client 2.4.0 names the operations of a subscription "as OpenADR 3.0.1 did". It does not: 3.0.1 names themREAD,CREATE,UPDATEandDELETE, as 3.1.0 does. The library names them with HTTP methods, which 3.0.1 uses only for theoperationof a notification. The v0.4.0 notes below say the same wrong thing.
Upstream notes
Observed by running v0.1.4 with baseline-301; details in docs/COMPATIBILITY.md.
- No
/subscriptions(404), which 3.0.1 defines. - A VEN cannot delete its own report (403); only Business Logic can. While a report exists, its event and program cannot be deleted (409).
GET /programs?targetType=VEN_NAME&targetValues=…finds nothing: program targets of that type are kept apart, as the list of VENs that may see the program. A VEN is shown such a program without its targets.- A VEN client without a ven sees no programs, not even untargeted ones.
- A bearer token the VTN did not issue is answered 403, which the 3.0.1 OpenAPI document allows.
Verification
On arm64: make validate lint images smoke interop conformance-test documents conformance. Smoke 33 (openleadr), 44 (elaadnl) and 32 (openleadr301) checks; self-test 73 checks passed and 5 skipped on declared capabilities, elaadnl → openleadr301 not paired; conformance of openleadr 20 of 24 scenarios, 4 known findings; 3 capability documents and 65 client results valid against their schemas.
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.5.0 |
v0.2.7 | sha256:4f8eb4b1795bd3f21307346eb8cff0e3860f9c9753e841710de50a5af1353ab5 |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.5.0 |
2.4.0 | sha256:3c8d2e56b87740f138d3e083303c8333a28cfe6d386aab1a9a009ae70c33d12f |
ghcr.io/otfabric/openadr-interop-openleadr301:v0.5.0 |
v0.1.4 | sha256:a2039fff5b7d3e4a3691883a543bb602b885a07ed8a3a2779fed238627c7e1a5 |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:4f8eb4b1795bd3f21307346eb8cff0e3860f9c9753e841710de50a5af1353ab5
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:3c8d2e56b87740f138d3e083303c8333a28cfe6d386aab1a9a009ae70c33d12f
OPENADR_INTEROP_OPENLEADR301_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr301@sha256:a2039fff5b7d3e4a3691883a543bb602b885a07ed8a3a2779fed238627c7e1a5manifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
2026-10-29:
manifest.jsonandchecksums.txtwere replaced. The first upload listed only 3.1.0 underopenadrVersions(fixed in #5); it now lists 3.1.0 and 3.0.1. Nothing else changed: the images and their digests are the same.
v0.4.0
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.4.0 |
v0.2.7 | sha256:b8221b89983a5b7cdc69cea92443e05416336ad1ddcd843250770d65950b4fb2 |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.4.0 |
2.4.0 | sha256:db5e0d61814fd12ab2c78926c482f15b466f1639a0eae692d58657f9fdfd093a |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:b8221b89983a5b7cdc69cea92443e05416336ad1ddcd843250770d65950b4fb2
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:db5e0d61814fd12ab2c78926c482f15b466f1639a0eae692d58657f9fdfd093amanifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.3.0
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.3.0 |
v0.2.7 | sha256:780fd3c7f39d3c3ddb80f8de372c22ff4e88f5e33bb29e4dc082b2fcaaa3a40e |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.3.0 |
2.4.0 | sha256:3e10097737c75de0d1d4b359e72a8b76a01ad8ab939844fad5aaf71dc75a20c8 |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:780fd3c7f39d3c3ddb80f8de372c22ff4e88f5e33bb29e4dc082b2fcaaa3a40e
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:3e10097737c75de0d1d4b359e72a8b76a01ad8ab939844fad5aaf71dc75a20c8manifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.
v0.2.0
Images
| Image | Upstream | Digest |
|---|---|---|
ghcr.io/otfabric/openadr-interop-openleadr:v0.2.0 |
v0.2.7 | sha256:a8fbdd858b15c4ccf797cd80695ab5b4abc11d1dcf6890efb7a8a03e98ef5f6c |
ghcr.io/otfabric/openadr-interop-elaadnl:v0.2.0 |
2.4.0 | sha256:a976273dab5481cb2e7c90af6a6200aad7ecb0ebbffa8a8022f6a48a2d64ccaa |
Pinning in a consumer
OPENADR_INTEROP_OPENLEADR_IMAGE=ghcr.io/otfabric/openadr-interop-openleadr@sha256:a8fbdd858b15c4ccf797cd80695ab5b4abc11d1dcf6890efb7a8a03e98ef5f6c
OPENADR_INTEROP_ELAADNL_IMAGE=ghcr.io/otfabric/openadr-interop-elaadnl@sha256:a976273dab5481cb2e7c90af6a6200aad7ecb0ebbffa8a8022f6a48a2d64ccaamanifest.json records the upstream versions these images were built from. The images contain third-party software under its own licences; see THIRD_PARTY_NOTICES.md and /licenses in each image. Notes: RELEASE.md.